15-Year-Old Sality Virus Still Delivering Monero Miners Today
A file-infector first flagged in 2010 is still being submitted in 2025, and the same indicator set includes two unrelated Monero-mining binaries disguised as Windows system processes. The infrastructure linking them is minimal — a single recycled self-signed certificate — pointing to a legacy worm's distribution rails repurposed for commodity cryptomining.
A file-infector that first appeared on antivirus radars in July 2010 is still being submitted for scanning in 2025 — and in the same indicator set, two unrelated cryptomining binaries are dressed up as core Windows processes, one as svcd.exe/vcuia.exe, the other as RuntimeBroker.exe. Nothing about the infrastructure behind this cohort is sophisticated: a single self-signed certificate labeled "localhost," minted in 2011 and still valid until 2038, is the only thread tying a Georgian IP to a…
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read