{"id":55623,"date":"2022-01-10T16:33:16","date_gmt":"2022-01-10T14:33:16","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=55623"},"modified":"2025-09-04T02:29:13","modified_gmt":"2025-09-03T23:29:13","slug":"hackers-modify-the-dnspy-debugger-for-covert-cryptocurrency-mining","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/hackers-modify-the-dnspy-debugger-for-covert-cryptocurrency-mining\/","title":{"rendered":"Hackers modify the dnSpy debugger for covert cryptocurrency mining"},"content":{"rendered":"<p>Researchers from MalwareHunterTeam have uncovered a malicious version of the dnSpy debugger that installs hidden miners and trojans on victims&#8217; computers.<\/p>\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\">\n<div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Someone made a dnSpy version that has a &#8220;gift&#8221;: https:\/\/github[.]com\/isharpdev\/dnspy<br \/>Until about an hour ago it was available here, then got renamed (probably to look more legit) to the above: https:\/\/the[.]com\/carbonblackz\/dnspy\/<a href=\"https:\/\/twitter.com\/GitHubSecurity?ref_src=twsrc%5Etfw\">@GitHubSecurity<\/a> <a href=\"https:\/\/t.co\/WZxhc7c7lC\">pic.twitter.com\/WZxhc7c7lC<\/a><\/p>\n<p>\u2014 MalwareHunterTeam (@malwrhunterteam) <a href=\"https:\/\/twitter.com\/malwrhunterteam\/status\/1479767752885874688?ref_src=twsrc%5Etfw\">January 8, 2022<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div>\n<\/figure>\n<p>dnSpy is commonly used by researchers and developers to modify and decompile programs. The software is also popular among cybersecurity professionals who analyse .NET malware.<\/p>\n<p>As of this writing, the debugger is no longer maintained by its original developers, but its source code <a href=\"https:\/\/github.com\/dnSpy\/dnSpy\">\u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d<\/a> \u043d\u0430 GitHub. There is also a developing <a href=\"https:\/\/github.com\/dnSpyEx\/dnSpy\">\u0432\u0435\u0440\u0441\u0438\u044f<\/a>, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043b\u044e\u0431\u043e\u0439 \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u043a\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c. \u0418\u043c\u0435\u043d\u043d\u043e \u044d\u0442\u0438\u043c \u0438 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0445\u0430\u043a\u0435\u0440\u044b.<\/p>\n<p>The malicious dnSpy variant can install hidden miners, the Quasar Trojan, and software that tampers with the clipboard and steals cryptocurrency. <\/p>\n<p>The cybercriminals even set up a dedicated site to promote their program (unavailable at the time of writing) and launched an advertising campaign in Bing, Yahoo, AOL, Yandex and Ask.com search results.<\/p>\n<p>So far, the malicious dnSpy version is detected only by a few antivirus engines.<\/p>\n<p>In late December 2021, unknown attackers exploited a vulnerability in the popular Log4j library to gain control of servers based on AMD EPYC <a href=\"https:\/\/forklog.com\/en\/news\/hackers-exploited-a-log4j-vulnerability-to-mine-on-hewlett-packard-servers\">for mining the Raptoreum cryptocurrency<\/a>. <\/p>\n<p>Follow ForkLog news on <a href=\"https:\/\/twitter.com\/ForkLog\" target=\"_blank\" rel=\"nofollow noopener\">Twitter<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>MalwareHunterTeam researchers have uncovered a malicious version of the dnSpy debugger that installs hidden miners and trojans on victims&#8217; computers.<\/p>\n","protected":false},"author":1,"featured_media":55624,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154],"class_list":["post-55623","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes"],"aioseo_notices":[],"amp_enabled":true,"views":"37","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/55623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=55623"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/55623\/revisions"}],"predecessor-version":[{"id":55625,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/55623\/revisions\/55625"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/55624"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=55623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=55623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=55623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}