{
  "family": "bitmin",
  "sample_count": 112,
  "category": "coinminer",
  "description": "Bitmin (cataloged under Microsoft Defender designations including Trojan:Win32/Bitmin, Trojan:Win32/Bitman, and CoinMiner.Win32.Bitman) is an enduring family of covert cryptocurrency mining trojans operating across Windows systems since 2011. Emerging alongside early Bitcoin mining exploits and subsequently adapting to privacy coins like Monero (XMR), Bitmin is engineered to quietly commandeer host processor (CPU) and graphics card (GPU) cycles without user authorization. Delivered via software cracks, torrented games, and drive-by droppers, the trojan extracts modified, embedded open-source mining engines (such as XMRig, cgminer, or custom stratum miners) directly into the AppData or Temp directories. Bitmin implements aggressive operational stealth: it continuously monitors active Windows processes and user interaction, instantly throttling or suspending hash computations whenever Task Manager (taskmgr.exe), Process Explorer, or graphics-intensive applications are detected. The miner connects to mining pools using the Stratum TCP protocol over custom non-standard ports (such as 3333, 4444, and 5555), causing chronic hardware degradation, thermal throttling, and enterprise power consumption spikes.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Bitmin",
    "Trojan:Win32/Bitman",
    "Trojan.Win32.Bitman",
    "CoinMiner.Win32.Bitman",
    "Riskware.Bitmin"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Bitmin?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Bitmin is a stealthy cryptocurrency mining trojan designed to hijack computer CPU and GPU resources to mine coins like Monero."
      }
    },
    {
      "@type": "Question",
      "name": "How does Bitmin conceal its high resource usage?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It monitors running processes and automatically pauses or throttles mining threads whenever Task Manager or system monitoring tools are opened."
      }
    },
    {
      "@type": "Question",
      "name": "What network protocols does Bitmin utilize?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It connects to remote mining pool servers using the Stratum mining protocol over TCP ports such as 3333, 4444, or 5555."
      }
    },
    {
      "@type": "Question",
      "name": "How is Bitmin typically delivered to endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is predominantly distributed through trojanized software installers, video game cracks, and deceptive freeware downloads."
      }
    },
    {
      "@type": "Question",
      "name": "Why is an unauthorized miner considered a critical security threat?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because its presence demonstrates an initial perimeter breach that could be leveraged by threat actors to drop ransomware or steal data."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1496",
    "T1053.005",
    "T1562.001",
    "T1059.003",
    "T1105",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking",
      "tactic": "Impact"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network to terminate outbound connections to mining pools and render the operation unprofitable.",
    "Use behavioral EDR monitoring to identify disguised worker processes executing from user directories with stratum arguments.",
    "Audit Windows Task Scheduler and Registry Run keys to remove the auto-start triggers for the mining binary.",
    "Block outbound connections to known mining pool domain names and stratum ports (3333, 4444, 5555) at the perimeter firewall."
  ],
  "what_to_avoid": [
    "Do not dismiss a Bitmin detection as mere harmless adware; investigate the initial access vector that allowed the miner to execute.",
    "Avoid relying solely on Task Manager to spot the miner, as the trojan is engineered to suspend threads during active inspection."
  ],
  "target_industries": [
    "Global / Opportunistic",
    "Higher Education",
    "Enterprise Workstations"
  ],
  "motivation": "Resource Hijacking",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "persistence",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2011,
  "lineage": {
    "derived_from": [
      "Early Bitcoin Miners"
    ],
    "variants": [
      "Bitmin.A",
      "Bitmin.BM!MTB",
      "Bitman.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b",
      "6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a"
    ],
    "delivery": [
      "Trojanized software cracks and key generators",
      "Drive-by payload download via malicious web redirects"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BitminUpdate",
      "Scheduled Task executing hidden miner binary from %AppData%\\Local\\Temp"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Bitmin",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bitmin"
    },
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Bitman",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Bitman"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}