Categories: Bitcoin Business

Bondnet Botnet Hijacks Windows Server Machines to Mine Monero and ZCash

Click here to view original web page at

It was only a matter of time until a new botnet would start making the rounds. It appears this new type of malware originates from China, albeit that has not been officially confirmed at this stage. So far, the botnet is comprised of 15,000 infected Windows Server machines, all of which are mining cryptocurrencies. Interestingly enough, the primarily mined cryptocurrency is Monero, and not Bitcoin.

Crypto-mining Botnet Has Grown More Powerful

It is always quite interesting to take note of new malware types designed to mine cryptocurrencies. Over the past few years, the world has seen multiple iterations of such malware. In most cases, these nefarious tools hijack computers to mine Bitcoin or even Dogecoin. However, that situation has come to change thanks to this newly discovered botnet.

To be more specific, the Bondnet botnet is capable of infecting any machine running the Windows Server operating system. It was first spotted back in December of 2016 when it had seemingly enslaved a handful of machines. That number has now grown to 15,000 controlled machines, all of which are used to mine a wide variety of popular cryptocurrencies. First and foremost, the infected machine will try to mine Monero, a cryptocurrency focusing on privacy and anonymous transactions.

However, it appears this malware can mine other cryptocurrencies as well. Interestingly enough, the developer of Bondnet has no interest in mining Bitcoin, Ethereum, or Litecoin right now. Instead, they opt to mine ByteCoin, RieCoin, and ZCash. These are quite interesting choices, although the hardware they hijack lends itself to profitably mining these coins over time. With 15,000 machines under the criminals’ control, they can mine a respectable amount of cryptocurrency at no additional cost.

This particular botnet has grown exponentially thanks to a time-consuming process. The developer relies on different techniques to infect machines all over the world. It is possible a combination of brute-force attacks and weak RDP credentials is the main source of distribution at this stage. Additionally, a lot of Windows Server-based machines run other server software, which can be exploited, including MSSQL, Apache Tomcat, and phpMyAdmin.

As one would somewhat expect, once the assailant gains access to the computer, he uses a Remote Access Trojan to control the machine moving forward. Installing a cryptocurrency-related miner becomes a trivial matter at that point. Over half of the infected machines run Windows Server 2008 R2, although a good portion runs Windows Server 2012 R2. It is evident nearly all popular versions of this operating system are prone to getting hijacked.

What is rather intriguing is how this botnet seems to gain and lose new bots every single day. The growth has all but stagnated, yet it remains a big threat until the matter can be properly resolved. Server administrators will need to step up their security game to prevent servers from getting hijacked for cryptocurrency mining purposes. Luckily, a detection and cleanup utility has been released by security firm GuardiCore.

If you liked this article, follow us on Twitter @themerklenews and make sure to subscribe to our newsletter to receive the latest bitcoin, cryptocurrency, and technology news.


Illuminati, Mason, Anonymous I'll never tell. I can tell you this, global power is shifting and those who have the new intelligence are working to acquire this new force. You matter naught except to yourself, therefore prepare for the least expected and make your place in the new world order.

Disqus Comments Loading...
Published by

Recent Posts

Is Boris Gone Landslide and How Would Bitcoin, Markets, React?

The sun has returned on London streets as Boris Johnson, the unelected British Prime Minister, once again covers our TV… Read More

3 hours ago

California Man Admits Masterminding $25 Million Bitcoin Launder Fest

A Los Angeles man has plead guilty to a multi-million money laundering scheme. | Source: Shutterstock By CCN Markets :… Read More

3 hours ago

WORLD NEWS: This Week in Blockchain and Crypto

This week has seen interesting developments around the globe on crypto projects and governments interest in the digital assets space.The… Read More

3 hours ago

Bitcoin Circuit: Is it a scam? Read our comprehensive review!

If you are looking for ways to speculate on cryptocurrencies, then I am sure you have thought about signing up… Read More

3 hours ago

Model: Bitcoin (BTC) Price to Surge 100% to $20,000 by May

In just around nine months, Bitcoin (BTC) will see its next block reward reduction — dubbed “halving”. Despite this rapidly… Read More

3 hours ago

Early Bitcoin Contributor Projected $10 Million BTC Price 10 Years Ago

Share Tweet Send Share Just a week after the bitcoin genesis block in January 2009, computer scientist Hal Finney published… Read More

3 hours ago

This website uses cookies. We use these cookies to collect data about your interaction with our website for the purpose of continuously improving your experience with our site. For more information we encourage you to read our privacy policy.

Read More