LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0451: LoudMiner

LoudMiner is a cryptocurrency miner which uses virtualization software to siphon system resources. The miner has been bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.[1]

EnterpriseS0451MalwareObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

LoudMiner matters because it turns employee endpoints into resource theft infrastructure: a cryptocurrency miner bundled with pirated VST software on Windows and macOS, using virtualization to hide activity and consume system resources. For leaders, the practical issue is not only malware cleanup; it is whether the organization can prevent untrusted software installation, detect unauthorized virtual machines, and prove endpoint monitoring can see persistence, execution, and resource abuse across both Windows and macOS fleets.

Executive priority

Prioritize this as an endpoint governance and resilience risk. The supplied ATT&CK relationships connect LoudMiner to compute hijacking, virtualization-based hiding, persistence via Windows services and macOS Launch Daemons, shell execution, ingress tool transfer, and discovery activity. Executives should ask whether software acquisition controls prevent pirated or unapproved tools, whether SOC telemetry covers macOS as well as Windows, and whether incident responders can distinguish legitimate virtualization or installer activity from resource-abuse malware.

Technical view

SOC and IR teams should validate behavior-based coverage rather than relying on a named-malware signature, because ATT&CK provides no official detection text for this object. Focus on Windows and macOS hosts where unapproved VST-related installers, virtualization processes, miner-like resource consumption, shell activity, encoded or obfuscated commands/files, file deletion, hidden files, and persistence changes occur together. Relationship-driven validation should include T1496.001 Compute Hijacking, T1564.006 Run Virtual Instance, T1543.003 Windows Service, T1543.004 Launch Daemon, T1569.001 Launchctl, T1569.002 Service Execution, T1059.003 Windows Command Shell, T1059.004 Unix Shell, T1105 Ingress Tool Transfer, and discovery commands tied to network, process, and system information.

Likely telemetry

  • Endpoint process creation and command-line logs for cmd, Unix shells, launchctl, service-control utilities, and msiexec
  • Windows service creation/modification events and related registry/service configuration evidence
  • macOS LaunchDaemon plist creation/modification and launchctl execution evidence
  • File creation, deletion, hidden-file attributes, and encoded/encrypted artifact metadata
  • Virtualization software installation, VM process activity, virtual disk/network artifacts, and host-to-VM resource usage indicators

Detection direction

  • Build detections around correlated behaviors: unauthorized virtualization plus sustained compute usage plus persistence or shell execution is higher value than any single event.
  • Validate both Windows and macOS coverage; macOS LaunchDaemon and launchctl monitoring is a common blind spot compared with Windows service monitoring.
  • Tune for legitimate virtualization, audio-production software, software installers, and administrator maintenance to reduce false positives while preserving alerts for unapproved software paths, hidden locations, or unusual parent-child process chains.
  • Treat obfuscated command execution, encoded files, and cleanup via file deletion as supporting evidence, especially when near installer execution or VM startup.
  • Confirm whether endpoint tooling can observe only the host or also activity inside virtual instances; ATT&CK notes virtualization can hide artifacts from tools that cannot monitor inside the VM.

Mitigation priorities

  • Strengthen software governance first: restrict pirated/unapproved software and maintain auditable software inventory for Windows and macOS endpoints.
  • Limit local administrative rights needed to install services, LaunchDaemons, virtualization software, or persistent background components.
  • Control and monitor virtualization software use; require business justification and alert on unauthorized VM creation or execution.
  • Apply application control or approved-software enforcement where feasible for installers, scripting shells, service utilities, and virtualization components.
  • Ensure endpoint hardening and logging cover macOS persistence mechanisms as well as Windows services.
Additional notes and limits

The key decision value is coverage validation: LoudMiner’s official ATT&CK description is narrow, but its relationships show a cross-platform behavior chain involving untrusted software delivery, shell execution, persistence, hiding through virtualization, discovery, cleanup, and compute-resource abuse. This should inform managed detection use cases, IR collection plans, endpoint governance, and audit evidence around approved software and administrative control.

ATT&CK provides no official detection guidance, no aliases, no labels, and no object-level tactics for LoudMiner in the supplied fields. The assessment is based only on the official description, the ESET external reference, and ATT&CK relationship context. Local prevalence, exposure to pirated VST software, and actual monitoring coverage must be confirmed from the customer environment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

LoudMiner

LoudMiner is a cryptocurrency miner which uses virtualization software to siphon system resources. The miner has been bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

18 rows
DomainIDNameRelationship / procedure
EnterpriseT1057Process Discovery

LoudMiner used the ps command to monitor the running processes on the system.[1]

EnterpriseT1569.001LaunchctlSub-technique

LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl. It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.[1]

EnterpriseT1027.010Command ObfuscationSub-technique

LoudMiner has obfuscated various scripts.[1]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

LoudMiner has encrypted DMG files.[1]

EnterpriseT1564.001Hidden Files and DirectoriesSub-technique

LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".[1]

EnterpriseT1059.004Unix ShellSub-technique

LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.[1]

EnterpriseT1543.004Launch DaemonSub-technique

LoudMiner adds plist files with the naming format com.[random_name].plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.[1]

EnterpriseT1496.001Compute HijackingSub-technique

LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.[1]

EnterpriseT1543.003Windows ServiceSub-technique

LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.[1]

EnterpriseT1189Drive-by Compromise

LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.[1]

EnterpriseT1016System Network Configuration Discovery

LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.[1]

EnterpriseT1105Ingress Tool Transfer

LoudMiner used SCP to update the miner from the C2.[1]

EnterpriseT1569.002Service ExecutionSub-technique

LoudMiner started the cryptomining virtual machine as a service on the infected machine.[1]

EnterpriseT1070.004File DeletionSub-technique

LoudMiner deleted installation files after completion.[1]

EnterpriseT1082System Information Discovery

LoudMiner has monitored CPU usage.[1]

EnterpriseT1564.006Run Virtual InstanceSub-technique

LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.[1]

EnterpriseT1218.007MsiexecSub-technique

LoudMiner used an MSI installer to install the virtualization software.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

LoudMiner used a batch script to run the Linux virtual machine as a service.[1]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1569.001: LaunchctlEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1564.001: Hidden Files and DirectoriesEnterpriseuses · TechniqueT1059.004: Unix ShellEnterpriseuses · TechniqueT1543.004: Launch DaemonEnterpriseuses · TechniqueT1496.001: Compute HijackingEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1189: Drive-by CompromiseEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1564.006: Run Virtual InstanceEnterpriseuses · TechniqueT1218.007: MsiexecEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
6a344fcf38f8d2a5...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.4Current bundle6a344fcf38f8…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  2. [2]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  3. [3]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  4. [4]
    mitre-attackS0451
    Open source URL
  5. [5]
    mitre-attackS0451
    Open source URL
  6. [6]
    mitre-attackS0451
    Open source URL
  7. [7]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  8. [8]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  9. [9]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  10. [10]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  11. [11]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  12. [12]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  13. [13]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  14. [14]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  15. [15]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  16. [16]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  17. [17]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  18. [18]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  19. [19]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  20. [20]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  21. [21]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  22. [22]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  23. [23]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  24. [24]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  25. [25]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  26. [26]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  27. [27]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  28. [28]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  29. [29]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  30. [30]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  31. [31]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  32. [32]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  33. [33]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  34. [34]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  35. [35]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  36. [36]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  37. [37]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  38. [38]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  39. [39]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
  40. [40]
    ESET LoudMiner June 2019

    Malik, M. (2019, June 20). LoudMiner: Cross-platform mining in cracked VST software. Retrieved May 18, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use