Cryptojacking Campaign Exploits Driver to Boost Monero Mining

**Executive summary:** Trellix uncovered a modular cryptojacking campaign distributed through pirated installers that installs a controller (Explorer.exe), multiple persistence watchdogs and a customised XMRig miner; it uses a signed vulnerable driver (WinRing0x64.sys, CVE-2020-14979) to obtain kernel access and disable CPU prefetchers to boost Monero RandomX hash rates, connects to a Kryptex mining pool for payouts, and contains a hardcoded expiration (December 23, 2025).