A recently published analysis by FortiGuard Labs’ FortiCNAPP team has revealed a sophisticated and multi-faceted attack campaign leveraging both well-known crypto-mining botnets and newly observed ransomware strains.
The attackers, believed to be behind the long-running H2Miner crypto mining campaigns, are now deploying a cocktail of malicious tools targeting Linux, Windows, and container environments, with the end goal of large-scale Monero mining, system disruption, and theft of sensitive information.
New AI-Generated Ransomware
H2Miner, active since 2019, has evolved by integrating legacy shell scripts for defense evasion and persistence with new variants, including Lcrypt0rx a VBScript-based ransomware first detected in November 2024.
Lcrypt0rx displays several signs of automated generation, such as duplicated functions, flawed persistence mechanisms, and ineffective attempts at disabling antivirus solutions.
Notably, code analysis with AI-detection tools flagged Lcrypt0rx as almost certainly generated using large language models, raising concerns over the rapid commoditization of cybercrime infrastructure.
The Fortinet report observes a unique overlap: operators are deploying both H2Miner’s classic crypto-mining malware along with the Lcrypt0rx ransomware, suggesting collaboration between threat actor groups or a campaign consolidation to maximize potential profits.
This hybrid approach spreads across infrastructure using commercial hacking tools and infostealers such as Kinsing, Lumma Stealer, DCRat, Cobalt Strike, and Amadey further intensifying the impact and complexity of the attacks.
Attack Chains
The attack lifecycle starts with adversaries targeting exposed Linux, Windows, and containerized workloads, often leveraging public VPS infrastructure to obfuscate their presence.
For Linux and cloud workloads, familiar scripts like ce.sh, spr.sh, and cpr.sh are used to halt defenses, remove competing malware, gain persistence, and deploy Kinsing RAT and crypto miners.
A PowerShell script (1.ps1) handles Windows XP and later systems, ensuring XMRig miners persist through scheduled tasks, with mining proceeds funneled to previously flagged Monero wallets.
The Lcrypt0rx ransomware, on the other hand, is spread on Windows targets. It attempts privilege escalation, disables critical system utilities, and interferes with user input by disabling modifier and function keys via registry manipulation.
Despite its broad attempts at data destruction overwriting the Master Boot Record, deleting backups, and encrypting user files with custom XOR routines Lcrypt0rx is marred by technical flaws, weak key management, and evidence of LLM hallucinations in its code.
Its encryption is considered weak, classifying it as scareware more than a genuine ransomware threat. Yet the campaign is dangerous due to its blend of visual defacement, persistent system interference, and bundled infostealers.
Organizations are urged to deploy updated network and endpoint protections, monitor for anomalous mining and C2 activity, and educate users against phishing and opportunistic threats.
Fortinet’s security stack detects and blocks campaign components with multi-layer signatures covering script loaders, RATs, miners, and ransomware, alongside network-level intrusion prevention that intercepts themed exploits, script deployments, and C2 communications.
Indicators of Compromise (IOCs)
| Type | IOC |
|---|---|
| IP Addresses | 78[.]153[.]140[.]66, 80[.]64[.]16[.]241, 89[.]208[.]104[.]175, 47[.]97[.]113[.]36, 176[.]65[.]137[.]203, 185[.]156[.]72[.]96, 80[.]64[.]18[.]161, 207[.]231[.]109[.]252, 104[.]21[.]32[.]1 |
| File Hashes | ff1706b37fea16d75b739a5396d9ffba, 9e4f149dae1891f1d22a2cea4f68432e, a729410de4dc397d1fb2ab8f7ae560d3, 2726145d4ef3b34d3c3a566177805c39, 1aee8a425ea53c571a16b8efde05ba01, B6cd214bb814362694cc48299ebaf0e5, 0680df49e1866c86697028ea73d28d28, d3884cc519c6855ae20d64264d5f6e93, 57f0fdec4d919db0bd4576dc84aec752, 44143827116c96f5dcace4f95dff8697 |
| Scripts | 1bf1efeadedf52c0ed50941b10a2f468, a7bee104bb486ad0f10331233cc9a9f1, 0dc2c71ce9c6c34668e9636abf61b1ae, 01e5b2530d4cba34f91c8090d19c92db, dbc9125192bd1994cbb764f577ba5dda, b3039abf2ad5202f4a9363b418002351, da753ebcfe793614129fc11890acedbc, ccef46c7edf9131ccffc47bd69eb743b, 06a482a6096e8ff4499ae69a9c150e92, f5f2b61b39105a2b1e6e1a5f4a3863ae, 9f764ec91535eaf03983b930d9f3bacd |
| Wallets | 4ASk4RhUyLL7sxE9cPyBiXb82ofekJg2SKiv4MKtCbzwHHLQxVVfVr4D4xhQHyyMTieSM5VUFGR9jZVR5gp6sa1Q2p8SahC, 89UoMhtsrpaJTvmJBbvy1cTdg38pomPFnW5Z4sniL2izcLQyGBkEGd96TcBJtzQUi6KAL5Ehe4cFpEMNdGF7tFKpJ1DqE8X, 89Arz88KTafhoTPAseYf2bfcWSjNq1YLaVY7ZkFaU21FivDueX4d7X7UErnyjAWHsVB1mibdTGHzqUTsS5FCMog89GVcQCh |
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates
