Tangerine Turkey Cryptomining Worm Spreads Via USB Drives, Hides Payloads with VBScript and LOLBins

Tangerine Turkey is a stealthy, financially motivated cryptomining campaign identified by Cybereason, which spreads via VBScript-based worms that travel through removable USB drives and deploy unauthorized cryptocurrency miners across compromised networks. First identified in late 2024, the operation has become globally active and targets organisations across industries, according to Cybereason.

The campaign leverages legitimate Windows binaries (LOLBins) such as printui.exe, wscript.exe, and xcopy.exe to blend malicious activity with normal system operations, with a VBScript dropper launching a batch file that continues the infection sequence.

It establishes persistence through malicious Windows services and scheduled tasks, including a rogue service named x665422 that points to a malicious DLL running under svchost.exe, and places the final payload in System32 as console_zero.exe designed to run at logon with elevated privileges, using XMRig to mine Monero.

Cybereason notes that the attackers also run obfuscated PowerShell commands to disable security measures and attempts to delete staging artifacts and the Windows directory as an anti-analysis tactic, though a path manipulation error halts the latter. According to Cybereason’s telemetry, the spread is primarily triggered when Windows executes a malicious VBScript from the removable drive, which then spawns a cmd.exe process to run the chain.