Microsoft-Tracked Cryptojacking Campaign Uses DLL Sideloading, ScreenConnect, and AI Search Manipulation

The evolution of cybercrime has entered a phase where traditional malware delivery is no longer sufficient for attackers seeking scale and profitability. Instead, adversaries are increasingly blending search engine manipulation, AI-assisted social engineering, legitimate remote administration tools, and Windows-native execution techniques into unified attack chains.

A recent cryptojacking campaign analyzed through OSINT threat intelligence highlights this convergence. The operation demonstrates how attackers are now weaponizing SEO poisoning, AI chatbot recommendation manipulation, and ScreenConnect abuse to deploy GPU-focused cryptocurrency miners through a deeply layered intrusion pipeline involving DLL sideloading, process hollowing, and .NET binary injection.

Unlike opportunistic botnet-style cryptojacking campaigns of the past, this activity reflects a deliberate targeting strategy aimed at high-value GPU systems, particularly those used by gaming enthusiasts, developers, and enterprise workstations.

Strategic Shift in Cryptojacking: From Volume Attacks to GPU Yield Optimization

Historically, cryptojacking campaigns prioritized infection volume over precision. Attackers would compromise as many endpoints as possible, regardless of hardware capability, and extract marginal gains through CPU mining.

However, this observed campaign signals a structural shift:

• Target selection is based on GPU capability

• Victims are sourced from software download intent signals

• Monetization relies on high-performance discrete GPUs

• Infection is maintained through long-term persistence mechanisms

Key targeting logic observed

Target characteristic	Reason for selection
GPU-rich systems	Higher mining profitability
Hardware monitoring software users	Likely advanced users
Gaming utilities seekers	Strong GPU presence
System optimization tools users	Administrative privileges more likely

This targeting precision reduces infection volume but dramatically increases per-host revenue.

AI Chatbots and SEO Poisoning as Dual-Channel Malware Delivery

One of the most significant findings in this campaign is the expansion of traditional SEO poisoning into AI-driven recommendation poisoning.

Dual-channel infection vector

Attackers are exploiting two parallel discovery systems:

1. Search engine poisoning

Users searching for tools such as:

• CrystalDiskInfo

• HWMonitor

• FurMark

• Display Driver Uninstaller (DDU)

• K-Lite Codec Pack

• PDFgear

are redirected to malicious lookalike websites.

2. AI chatbot recommendation manipulation

Security telemetry indicates that users querying AI chatbots for software recommendations were sometimes provided with malicious links embedded in generated responses.

This represents a major evolution in social engineering:

• Instead of ranking pages, attackers influence model-generated suggestions

• Instead of SEO ranking manipulation alone, they exploit LLM response trust

“This behavior represents an extension of traditional SEO poisoning beyond conventional search engines,” security researchers noted in threat analysis reports.

Fake Software Ecosystem and Brand Impersonation Strategy

The campaign heavily relies on impersonation of trusted software utilities widely used in hardware diagnostics and system optimization.

Common impersonated applications

• CrystalDiskInfo

• HWMonitor

• FurMark

• K-Lite Codec Pack

• PDFgear

• Display Driver Uninstaller

These tools are not randomly selected. Their user base shares a common trait: high-performance hardware ownership, especially GPUs.

Strategic impersonation rationale

Attackers exploit behavioral predictability:

• Users searching for hardware tools are more likely to trust download prompts

• Enthusiast communities often bypass security scrutiny for utility software

• Drivers and benchmarking tools often require administrative privileges

This combination creates ideal conditions for silent malware installation.

Infection Chain Architecture: From ZIP Archive to System Compromise

The infection chain demonstrates a multi-stage execution design engineered for stealth and persistence.

Stage 1: ZIP-based delivery

Victims download a ZIP archive containing:

• A legitimate executable (decoy application)

• A malicious DLL named autorun.dll

Stage 2: DLL sideloading execution

When executed, the legitimate binary loads autorun.dll through DLL sideloading.

This technique is effective because:

• No exploit is required

• No elevated prompts appear

• Execution appears legitimate to the OS

Multiple variants of autorun.dll were observed across campaigns, indicating active development and iteration.

Stage 3: Silent ScreenConnect deployment

The malicious DLL invokes msiexec.exe to install a disguised payload:

• vcredist_x64.dll

Despite its naming, this file installs ScreenConnect (ConnectWise Control), a legitimate remote administration tool.

Abuse significance

ScreenConnect enables attackers to:

• Maintain persistent remote access

• Execute commands interactively

• Transfer files directly

• Operate under legitimate RMM trust boundaries

This transforms the infection from malware execution into remote operator-controlled compromise.

Remote Access Infrastructure and Command Channel Abuse

Once ScreenConnect is active, the attacker connects to infrastructure controlled via dynamic DNS and external hosting.

Observed communication includes:

• ScreenConnect client sessions connecting to attacker-controlled endpoints

• Use of identifiers embedded in connection parameters

• Persistent session-based command execution

Key infrastructure behavior

• Remote session initiation via ScreenConnect client service

• Use of dynamic DNS domains such as directdownload.icu

• Long-lived attacker-controlled session channels

• File transfer capability enabling payload injection

This stage effectively converts the victim machine into a remotely managed mining node.

Advanced Execution Layer: Process Hollowing and .NET Abuse

The campaign’s most sophisticated technique involves process hollowing into Microsoft-signed .NET binaries.

Targeted legitimate binaries include:

• InstallUtil.exe

• RegAsm.exe

• RegSvcs.exe

• MSBuild.exe

• AppLaunch.exe

• AddInProcess.exe

• aspnet_compiler.exe

Execution method

1. A suspended process is created using a legitimate binary

2. Memory is overwritten using WriteProcessMemory

3. Execution context is redirected

4. Malicious payload runs under trusted process identity

This allows attackers to:

• Evade endpoint detection systems

• Blend into legitimate Windows processes

• Bypass application trust models

Security analysts highlight this as a “trusted execution camouflage model,” where malware inherits legitimacy from signed system binaries.

Persistence Engineering: Multi-Layer Autostart Reinforcement

The malware implements a redundant persistence framework designed to survive cleanup attempts.

Persistence mechanisms observed

Mechanism	Implementation
Scheduled tasks	System Health, Monitor, Check cycles
Registry Run keys	HKLM and HKCU persistence
Startup folder shortcut	LNK file execution
Hidden install directory	Cache-based storage path

Scheduled task strategy

• Executes at logon

• Executes at system boot (delayed)

• Executes every 5 minutes

This ensures continuous reinfection of runtime components even after termination.

Defense Evasion and Anti-Analysis Design

The malware includes extensive anti-analysis logic designed to terminate execution in controlled environments.

Detection methods include:

• Virtual machine registry artifacts (VMware, VirtualBox)

• BIOS and hardware fingerprint checks

• MAC address pattern analysis

• WMI system queries

Analyst tool detection list includes:

• Wireshark

• Process Monitor

• x64dbg

• IDA

• Ghidra

• dnSpy

If any of these are detected, execution halts immediately.

Cryptomining Payload Strategy and GPU Optimization

Once deployed, the final payload does not embed mining software directly. Instead, it dynamically downloads mining tools:

• gminer

• lolMiner

• SRBMiner-MULTI

Mining logic includes:

• GPU temperature monitoring

• CPU/GPU utilization tracking

• Idle-state detection

• Gaming activity detection

Mining is automatically paused when:

• High GPU usage is detected

• User activity resumes

• Diagnostic tools are launched

This ensures stealth operation and reduces detection risk.

Command and Control (C2) Infrastructure and Encryption Model

The campaign uses a hardened C2 architecture featuring:

• AES-128-CBC encrypted configuration blobs

• Embedded TLS certificate pinning

• WebSocket-based communication channel

Observed C2 endpoint

• wss://minemine.gleeze.com:8443/ws

Infrastructure pivoting

Certificate reuse analysis revealed multiple IPs tied to shared TLS fingerprints:

• 93.115.10.35

• 198.23.185.238

• 2.59.132.106

Further OSINT pivoting linked infrastructure to DynamicDNS ecosystems and related domains:

• direct-download.giize.com

• free-download.giize.com

This indicates a broader campaign cluster rather than a single isolated operation.

Operational Security Failures and Campaign Attribution Patterns

Despite advanced execution techniques, the campaign reveals several operational fingerprints:

• Reuse of identical install identifiers (D3F4E2A1)

• Consistent mutex naming conventions

• Repeated ScreenConnect deployment pattern

• Shared TLS certificate across multiple nodes

• Recurrent domain structure patterns

These consistencies suggest a centralized operator framework or toolkit reuse across multiple campaigns.

Defensive Implications for Modern Security Architectures

This campaign demonstrates that modern cyber defense must evolve beyond signature-based detection.

Key defensive priorities include:

• Monitoring RMM tool abuse (ScreenConnect, AnyDesk, TeamViewer)

• Detecting DLL sideloading from user-writable directories

• Blocking unsigned scheduled task creation patterns

• Monitoring Defender exclusion modifications

• Enforcing ASR rules for unknown executables

• Behavioral GPU usage anomaly detection

Strategic Cybersecurity Insight: The Convergence of AI, SEO, and Malware Delivery

The most significant takeaway from this campaign is not cryptojacking itself, but the convergence of three ecosystems:

• AI-generated recommendation systems

• Search engine ranking manipulation

• Legitimate remote administration tools

This convergence creates a hybrid attack surface where trust is no longer anchored in infrastructure, but in information delivery systems themselves.

As attackers continue to adapt, enterprises must assume that:

• Search results may be poisoned

• AI responses may be manipulated

• Trusted tools may be weaponized

The Industrialization of AI-Assisted Cybercrime

This cryptojacking campaign illustrates a broader transformation in cybercrime economics. Attackers are no longer relying solely on malware distribution; they are engineering full-stack ecosystems that combine:

• Behavioral targeting

• AI-assisted social engineering

• Legitimate software abuse

• Advanced persistence mechanisms

• GPU-optimized monetization

The result is a highly efficient cryptomining operation capable of sustained, low-noise revenue generation at scale.

The intersection of AI-driven discovery systems and traditional malware delivery creates a fundamentally new attack paradigm that security teams must now defend against proactively.

For deeper intelligence perspectives and advanced cyber defense research, initiatives by experts such as Dr. Shahid Masood and analytical frameworks developed by the 1950.ai expert team provide valuable insight into the evolving AI-threat landscape.

Further Reading / External References

• SOC Prime Threat Report – Cryptojacking Campaign Using ScreenConnect

  https://socprime.com/active-threats/from-poisoned-search-results-to-gpu-mining-a-cryptojacking-campaign-using-screenconnect-and-net-utilities/

• Microsoft Poisoning and ScreenConnect Abuse:

  https://www.microsoft.com/en-us/security/blog/