Stealth Cryptominer Uses USB LNK and DLL Side-Loading to Deploy “Smart Mining” Evasion

According to AhnLab SEcurity Center (ASEC), a sophisticated CoinMiner campaign is spreading via USB drives in South Korea, turning infected workstations into cryptocurrency miners. The February 2025 report tracks the new strain, also monitored by Mandiant as DIRTYBULK and CUTFAIL, which reuses legitimate Windows system files to evade detection.

The infection begins with a USB drive shortcut named “USB Drive.lnk” that leads to a hidden sysvolume directory, after which a VBS script and a BAT file unleash a DLL side-loading chain to load printui.dll in place of a trusted printui.exe. The Dropper Chain eventually deploys a service-starting payload, culminating in the PrintMiner configuration that runs XMRig to mine Monero while avoiding detection by pausing during resource-heavy games or when Task Manager is opened.

Defences include PowerShell-based defender exclusion, changed power settings to prevent sleep, and the instruction to show hidden files to spot the sysvolume folder on removable media.