Using BT tools to spread mining programs, nearly 400,000 PCs have become mining machines

Microsoft said the MediaGet compromise was a carefully planned operation that began in mid-February, with attackers using advanced cross-process injection, persistence mechanisms and evasion techniques.

Microsoft discovered that mediaget.exe obtained the signature of another software company's certificate and downloaded the program update.exe from the MediaGet server, which then installed an unsigned pirated version of mediaget.exe. update.exe is an InnoSetup SFX file. After obtaining the signature of another software company, it downloaded the pirated version of mediaget.exe from an external C&C server. It is 98% similar to the normal software, and the only difference is that it contains a mining backdoor.

Currently, MediaGet is used by a large number of users abroad, and this attack may affect more than 400,000 computers worldwide.