{
  "family": "idlebuddy",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "PUA:Win32/Idlebuddy is a persistent Potentially Unwanted Program (PUA) that functions primarily as a stealthy **Cryptominer** and distributed computing node. It is designed to hijack the infected endpoint's CPU and GPU resources to mine cryptocurrency (often Monero) for the developers, specifically engineering its execution to only occur when the user is away from the computer to evade detection.<br><br><b>Understanding the Idlebuddy Threat</b><br>To an end-user, Idlebuddy is designed to be invisible. They might occasionally notice the computer's fans spinning loudly when they walk into the room, but the noise stops as soon as they move the mouse. For an enterprise, Idlebuddy represents the theft of computing resources (Cryptojacking), resulting in increased electricity costs, hardware degradation, and severely reduced endpoint lifespan.<br><br><b>Execution and Evasion Mechanics</b><br>Idlebuddy is heavily distributed via software bundlers, often hidden inside installers for free games or utility software (`T1189`). Upon execution, it installs itself deeply into the system, establishing persistence via Registry Run keys or hidden Scheduled Tasks (`T1547.001`). Its defining characteristic is its evasion routine (`T1489`). It utilizes Windows APIs (like `GetLastInputInfo`) to monitor keyboard and mouse activity. The actual mining payload (often a modified version of XMRig) is only launched when the system has been completely idle for a specific duration (e.g., 10 minutes). The moment the user moves the mouse or opens the Task Manager, Idlebuddy instantly suspends or kills the mining process, dropping CPU usage back to normal before the user can see what was causing the lag.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is resource theft and hardware wear. Host-based IoCs include EDR alerts for the creation of processes resembling known cryptominers (e.g., `ib.exe`, `idlebuddy.exe`), or sudden, massive spikes in CPU/GPU utilization that immediately drop when a user logs in. Network IoCs include continuous outbound traffic to known cryptocurrency mining pools (e.g., Stratum protocol traffic) over non-standard ports (like 3333 or 4444) when the machine is locked.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Idlebuddy and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Idlebuddy is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Idlebuddy establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Idlebuddy typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Idlebuddy compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Idlebuddy should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Idlebuddy leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Idlebuddy frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Idlebuddy maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Idlebuddy often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1496",
    "T1489",
    "T1189",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking (Cryptomining)",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1489",
      "name": "Service Stop (Suspending the miner when Task Manager opens)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to attempt uninstallation of the software; however, Idlebuddy often uses deceptive uninstallers that leave the mining components behind.",
    "Deploy an enterprise adware/PUA removal tool to locate and strip the hidden scheduled tasks and registry hooks.",
    "Review firewall logs for any endpoints establishing long-lived TCP connections to known cryptocurrency mining pools, and block those IPs at the perimeter.",
    "If the software was installed without administrative privileges, audit the user's `%AppData%` folder for the hidden executables."
  ],
  "what_to_avoid": [
    "Do not rely solely on the Windows Task Manager to find the malware, as its primary evasion tactic is to hide from it.",
    "Avoid ignoring cryptominers; while they don't steal data, the initial access vector that allowed the miner in could be used to deploy ransomware next time."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}