SilentCryptoMiner, a malware designed to hijack system resources for cryptocurrency mining, has been downloaded on over 28,000 systems in Russia, Turkey, and Ukraine. The campaign behind these infections promotes the malware as legitimate software on YouTube and GitHub repositories, and hides in game cheat codes, trading bots, and pirated office-related software. The fake software downloads are contained in a password-protected zip file, which when opened drops obfuscated scripts, DLL files, and an AutoIT interpreter that launches the main payload. As with most modern malware, the malicious download checks for the presence of debugging tools prior to preceding. The malware hijacks legitimate Windows system services and browser update processes to ensure it is executed upon launch of those processes. The Ncat network utility is used for command-and-control (C2) communications. There are two (2) main payloads of the infection. The first is “DeviceId.dll” which executes the SilentCryptoMiner malware to mine cryptocurrency using victim machine resources. The second is “7zxa.dll” which monitors the Windows clipboard for patterns resembling a cryptocurrency wallet address and replaces the string with a different wallet address under the attacker’s control. Researchers have noted that this clipper functionality has stolen at least $6,000 worth of transactions by diverting victim funds to the attackers’ wallets. CTIX analysts recommend that organizations and individuals do not download software from unvetted sources or websites. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.