Monero Miners Continue to Plague Users via Russian Bit Torrent Site
Summary: A Russian BitTorrent site, b-tor[.]ru, has been bundling malware with legitimate files since September 2017, serving users a compressed .torrent.zip that unpacks to a double-extension .exe disguised with the uTorrent icon. Executing it downloads the expected torrent while silently installing a four-stage .NET chain that drops an XMRig Monero miner configured to use 100% of the victim's CPU.
Why it matters: The site hosts over 275,000 unique torrent files, and the miner, the dropper, and the XMRig proxy all resolve to a single IP address, 185.154.13[.]213, showing one actor running the whole operation end to end.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026