Threat Advisory: XMRig Cryptomining By Way Of TeamViewer

Huntress SOC investigated a series of XMRig cryptocurrency miner infections discovered in May 2023 where attackers gained initial access via compromised TeamViewer credentials, used clipboard and PowerShell/batch scripts to download and execute a miner payload from domains hosted on OSS-accelerate and other locations, and persisted via a Windows service; the report includes timelines reconstructed from EDR and Windows event logs, IOCs (malicious domains and wallet), MITRE ATT&CK mappings, and a high-fidelity EQL detection to identify similar infections.