9/3/25, 4:57 PM

Darktrace’s blog reports that researchers from Cado Security Labs (now part of Darktrace) identified a novel cryptomining campaign that exploits exposed Jupyter Notebooks on Windows and Linux to deliver a cryptominer. The campaign uses UPX-packed binaries to decrypt and execute mining software, with the Windows loader dropping a 64-bit Binary[.]freedllBinary that loads a secondary payload called java.exe and ultimately deploys a cryptominer.

The ELF Linux variant is delivered via a chained sequence of scripts and binaries, ultimately mining Monero and other coins such as Sumokoin, ArQma, Graft, Ravencoin, Wownero, Zephyr, Townforge and YadaCoin. The attackers’ method involves misconfigured Jupyter notebooks and a PowerShell/JS-based loader chain, with encrypted data and multiple stages including a loader written in AutoIt and a secondary payload downloaded from external hosts.

The campaign’s analysis notes the use of cron scheduling, GitHub/Gitee hosting, and a Monero mining endpoint (monerooceans[.]stream) detected by the defender’s telemetry. Published on 13 March 2025, the article highlights how cryptomining campaigns continue to exploit misconfigurations to monetise processing power.