PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2
PowerShell Cryptomining Loader Abuses Registry-Resident (TL-2026-2593) is a medium-severity malware campaign, first published 2026-09-20. It has no confirmed attribution, affects Microsoft Windows, references 1 CVE (CVE-2020-14979), maps to 16 MITRE ATT&CK techniques (T1001.002, T1027, T1036), and is covered by 9 detection rules and 19 indicators of compromise.
Key facts for TL-2026-2593
- Threat ID
- TL-2026-2593
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-20
- Last reviewed
- 2026-09-20
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in PowerShell Cryptomining Loader Abuses Registry-Resident
Malware and tooling: xmrig, WinRing0.sys / WinRing0x64.sys
A multi-stage, fileless PowerShell campaign stores an encoded loader in the Windows Registry, retrieves C2 instructions via DNS TXT records, and hides subsequent .NET payloads inside a PNG's red pixel channel and WAV audio data to deploy an in-memory XMRig RandomX miner, while establishing persistence via Defender exclusions, hidden Scheduled Tasks, and a WMI permanent event subscription.
How PowerShell Cryptomining Loader Abuses Registry-Resident works
K7 Security Labs identified the campaign after repeated PowerShell-activity alerts on a monitored Windows host. The infection begins with a PowerShell process launched using -NoProfile and an execution-policy bypass, which reads and decodes an encoded script stored directly in the Registry value HKLM:\Software\uf42a9660377\vstdfehzr rather than as a .ps1 file on disk, limiting the malware's forensic footprint from the outset.
The registry-resident script queries DNS TXT records for sslvalidcert.com (later rotated to txtcdn.net) using Resolve-DnsName; the TXT response carries comma-separated decimal values that are converted to ASCII to reconstruct a payload URL, frames-1zm.pages.dev/frames.png. The script then extracts data from the red colour channel of that PNG's pixels to reconstruct and execute a further stage, which opens a command channel to receive additional PowerShell instructions and downloads two WAV containers -- Atsg.wav and Tmav.wav -- from Cloudflare Pages-hosted domains. Both WAV files are decoded by skipping the standard 44-byte WAV header and recombining the lower nibbles of consecutive bytes to reconstruct embedded .NET assemblies, which are loaded directly into memory via [Reflection.Assembly]::Load() rather than written to disk.
The Atsg.wav stage performs defense evasion and persistence: it sets the PowerShell execution policy to Bypass, adds broad Microsoft Defender exclusions, disables/clears PowerShell command history, installs hidden Scheduled Tasks that fire at logon and on a recurring interval, and creates a WMI permanent event subscription that monitors Registry conditions to re-trigger the chain across reboots. It also generates a 20-character hardware identifier stored in the Registry and used as an X-HWID header on subsequent HTTP/HTTPS POST requests, and performs DNS-over-HTTPS lookups against Google's public resolver for TXT records at httptls.org to rediscover C2 endpoints if the primary channel is blocked.
The Tmav.wav stage reconstructs and in-memory-loads the XMRig miner, configured for the RandomX (rx/0) algorithm against a Monero mining pool over TLS with a keepalive channel and a CPU thread-count hint of up to 40, with live pool/wallet/threading parameters pulled from remote config resources (config-rg7.pages.dev/config.txt, softtestcopapool.pages.dev/rxconfig.txt). To optimize RandomX performance the malware also drops the signed kernel driver WinRing0.sys / WinRing0x64.sys, whose 1.2.0 build (as bundled in EVGA Precision X1 through 1.0.6) is tracked under CVE-2020-14979: the driver lets any local process, including low-integrity ones, read and write arbitrary physical memory by mapping \Device\PhysicalMemory, granting NT AUTHORITY\SYSTEM-equivalent MSR/memory access without a Windows kernel exploit. A separate defense-evasion DLL (fp.dll) further modifies PowerShell profiles and disables Defender services/scheduled tasks. All observed C2 traffic converges on 104.21.2.193:8443, an IP inside Cloudflare's shared anycast range. K7 Labs assesses that even after the miner is remediated, the underlying C2 channel could persist and deliver payloads beyond cryptomining. No CVE is required for initial execution, no actor attribution or campaign name is given in reporting, and the observed motivation is financial (Monero mining).
MITRE ATT&CK techniques used in TL-2026-2593
Command and Control
T1001.002 Steganography; T1071.001 Web Protocols; T1071.004 DNS; T1132.002 Non-Standard Encoding
Stealth
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.003 Clear Command History; T1140 Deobfuscate/Decode Files or Information; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task; T1546.003 Windows Management Instrumentation Event Subscription
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Impact
Affected products and versions in PowerShell Cryptomining Loader Abuses Registry-Resident
- Microsoft — Windows
Vulnerable versions: all Windows versions capable of running PowerShell and loading the dropped WinRing0 kernel driver - EVGA (WinRing0 redistribution) — WinRing0.sys / WinRing0x64.sys
Vulnerable versions: 1.2.0, as bundled in EVGA Precision X1 through 1.0.6, and other software redistributing this build
Remediation for PowerShell Cryptomining Loader Abuses Registry-Resident
Patches
- Remove or update software bundling WinRing0.sys/WinRing0x64iotoolkit build 1.2.0 (e.g., EVGA Precision X1 through 1.0.6) per CVE-2020-14979 to eliminate the underlying vulnerable driver.
Immediate actions
- Block DNS resolution to sslvalidcert.com, txtcdn.net, and httptls.org at the resolver/firewall.
- Block outbound HTTP/HTTPS to 104.21.2.193:8443 and alert on any outbound HTTP request carrying an X-HWID header.
- Hunt for and remove the registry value HKLM:\Software\uf42a9660377\vstdfehzr and any similarly-structured encoded PowerShell blobs under HKLM:\Software.
- Audit Microsoft Defender exclusion lists for entries added outside change-management and remove unauthorized exclusions.
- Enumerate hidden Scheduled Tasks and WMI permanent event subscriptions (__EventFilter/__EventConsumer/__FilterToConsumerBinding under root\subscription) for unrecognized entries tied to PowerShell execution.
Workarounds
- Where the WinRing0 driver cannot be removed outright, enforce HVCI/Windows Defender Application Control rules that block the driver by file hash or signing certificate.
Longer-term hardening
- Deploy Microsoft's vulnerable/blocklisted driver policy (WDAC or Attack Surface Reduction 'Block abuse of exploited vulnerable signed drivers') to prevent WinRing0.sys/WinRing0x64.sys from loading.
- Enable PowerShell Script Block Logging and Constrained Language Mode to reduce the blast radius of registry-resident, in-memory script execution.
- Monitor for anomalous DNS TXT record volume and DNS-over-HTTPS traffic to non-corporate resolvers as a potential C2-discovery channel.
- Baseline and alert on endpoint outbound requests to *.pages.dev and similar free static-hosting domains, which served as the steganographic payload CDN in this campaign.
CVEs associated with PowerShell Cryptomining Loader Abuses Registry-Resident
CVE-2020-14979
Timeline of PowerShell Cryptomining Loader Abuses Registry-Resident
- The Tmav.wav stage reconstructs and loads XMRig configured for RandomX (rx/0) with remote pool/wallet/thread settings, and drops WinRing0.sys for CPU MSR access, calling back to 104.21.2.193:8443.
- A 20-character hardware identifier is generated and stored in the Registry, subsequently sent as an X-HWID header on HTTP/HTTPS POST requests to the C2.
- Hidden Scheduled Tasks (logon and recurring triggers) and a WMI permanent event subscription monitoring Registry conditions are installed to survive reboots.
- The Atsg.wav stage sets PowerShell execution policy to Bypass, adds Microsoft Defender exclusions, and clears PowerShell command history.
- Reconstructed .NET assemblies are loaded directly into memory via [Reflection.Assembly]::Load(), avoiding disk writes.
- Atsg.wav and Tmav.wav are retrieved from Cloudflare Pages-hosted domains and decoded by skipping the 44-byte WAV header and recombining low nibbles of consecutive bytes to reconstruct .NET assemblies.
- The script downloads frames-1zm.pages.dev/frames.png and extracts hidden script content from the image's red pixel channel to reconstruct and execute a further stage.
- The loader queries DNS TXT records for sslvalidcert.com (later txtcdn.net) for comma-separated decimal values decoded to ASCII, reconstructing a payload URL.
- Registry-resident PowerShell is launched with -NoProfile and an execution-policy bypass, reading and decoding the encoded stage stored at HKLM:\Software\uf42a9660377\vstdfehzr in memory.
- K7 Security Labs identifies the campaign after repeated security alerts indicate suspicious PowerShell activity on a monitored host.
- GBHackers publishes coverage summarizing K7 Security Labs' technical findings and the full IOC set.
Sources cited for PowerShell Cryptomining Loader Abuses Registry-Resident
- PowerShell Malware Abuses Registry and DNS TXT Records to Deploy XMRig Crypto Miner
- From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection Chain
- Hackers Hide PowerShell Malware in Registry, PNG and WAV Files to Deploy XMRig Miner
- Registry-Resident PowerShell Chain Deploys In-Memory XMRig Miner
- NVD - CVE-2020-14979
- VulnerableDriver:WinNT/Winring0.A threat description
- Windows: Vulnerable WinRing0 Driver Load
More in malware
- RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs, and MFA Codes
- FomoPeek iOS App Store Poisoning: Kernel Exploit Framework Steals Crypto Private Keys via Keychain Decryption
- ClearFake Drive-By Cluster Fuels CastleLoader Paste-and-Run Delivery of NetSupport RAT, CastleRAT, and a .NET Stealer
- MovieReaper Malware Spreads Through Pirated Movie Torrents and Uses Solana Blockchain for C2
- AI-Powered Polymorphic Malware Queries LLMs at Runtime to Evade Signature Detection: PROMPTFLUX and PROMPTSTEAL/LAMEHUG (APT28)
Detection coverage for TL-2026-2593
As of 2026-09-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2593 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.