PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner

A K7 Security Labs analysis describes a sophisticated cryptomining campaign that obfuscates multi-stage PowerShell payloads via Registry-resident scripts, DNS TXT records, PNG steganography, and WAV-hosted .NET assemblies to deploy an XMRig RandomX miner; the malware uses in-memory execution, persistence (scheduled tasks and a WMI permanent event), Defender exclusion modifications, and drops WinRing0.sys, and the report includes detailed IOCs (domains, URLs, file hashes, registry path, and a C2 IP).