Breaking down a two-year run of Vivin’s cryptominers
Summary: Cisco Talos identified a threat actor it tracks as "Vivin" running a cryptomining campaign active since at least November 2017, mining thousands of U.S. dollars in Monero from infected hosts. Vivin delivers malware through modified pirated software, then pivots to living-off-the-land Windows tools, dropping a packed XMRig miner configured to use up to 80 percent of the host's CPU with the CryptoNight algorithm.
Key Takeaway: Vivin's operational security is poor enough that the actor posted its own Monero wallet addresses on Reddit, yet the campaign has run for two years and rotates wallets and infrastructure when exposed - a reminder that indiscriminate, low-sophistication actors can still sustain long-term resource abuse and potential data theft.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026