Threat Actors Deploying CoinMiner Malware via USB Drives Infecting Workstations

A USB-spread CoinMiner campaign in South Korea uses deceptive shortcut files and a hidden “sysvolume” folder to execute VBS/BAT/DLL dropper components that install XMRig for Monero mining; the malware establishes persistence by registering a DLL with the DcomLaunch service, modifies Defender exclusions, downloads encrypted payloads from C2 servers, and employs process-monitoring evasion to avoid detection.