cryptominer
XMRig
The open-source Monero miner every cryptojacking kit on the site deploys. Named by 2 reports, 0 detection rules, 2 IOC feeds and 3 tracked actors.
Reports
Detection rules
No published YARA rule names this family in its metadata.
IOC feeds
IOC feed
GOCLOUD Multi-Service Cryptojacking
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-016: GHOST cryptojacker kit customer (operator A) with self-hosted mining pool proxies
- UTA-2026-017: GHOST cryptojacker kit customer (operator B) using public mining pools, host abandoned
- UTA-2026-020: Self-branded commodity cryptojacking operator mass-exploiting exposed Chinese enterprise software
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.