Tor2Mine is up to their old tricks — and adds a few new ones
Summary: Cisco Talos observed resurgent Tor2Mine activity between January and June 2020 affecting at least six companies, with the actor using Tor2web services to bridge to the Tor network for command and control and hiding its C2 server's IP address. Alongside its usual XMRig cryptominer, Tor2Mine deployed AZORult information-stealing malware, the Remcos remote access tool, the DarkVNC backdoor trojan, and a clipboard cryptocurrency stealer, using PowerShell and Mshta to pull .ps1 and .hta files from domains including v1[.]fym5gserobhh[.]pw and asq[.]r77vh0[.]pw.
What's compelling: A group that once only mined coins is now harvesting credentials with AZORult and Remcos, and Talos assesses that if cryptomining stops paying, actors like this will likely diversify into more dangerous threats such as ransomware.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026