Elastic Security Labs steps through the r77 rootkit

Elastic Security Labs analyzes a stealthy campaign deploying the open-source r77 userland rootkit to hide and persistently install the XMRig crypto miner across systems in multiple Asian countries; the report details the install/stager/service/core modules, AMSI bypass, API unhooking, process hollowing with parent PID spoofing, registry- and scheduled-task-based persistence, included YARA detection rules, and provides IoCs (malicious domain, IPs, and multiple SHA-256 hashes).