[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0MqGSdKX-idT5dvDbZcEj-SVU5awbd6cn6FAs6gaznI":3},{"article":4,"iocs":45,"watch_terms":49,"solutions":50,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"28e76571-e067-477f-99cb-fe306e087f64","CryptoBandits Malware Doubles as a Backdoor, Abuses Tor","cryptobandits-malware-doubles-as-a-backdoor-abuses-tor-9803d7","CryptoBandits uses a local SOCKS5 proxy for traffic routing, blending data theft with remote code execution. The post CryptoBandits Malware Doubles as a Backdoor, Abuses Tor appeared first on SecurityWeek.","Microsoft has identified CryptoBandits, a Windows-based malware that functions as a backdoor and cryptocurrency clipper. It steals wallet information, replaces wallet addresses to hijack funds, and can execute remote code. The malware utilizes a bundled Tor client and a local SOCKS5 proxy for command-and-control communication, making it difficult to trace.","CryptoBandits malware steals crypto, executes remote code, and abuses Tor for C2.","https:\u002F\u002Fwww.securityweek.com\u002Fcryptobandits-malware-doubles-as-a-backdoor-abuses-tor\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002Fmalware.jpeg","2026-06-19T11:19:41+00:00","2026-06-19T12:00:07.406731+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Windows","product",{"name":21,"type":22},"Tor","technology",{"name":24,"type":22},"SOCKS5 proxy",{"name":26,"type":22},"Windows Script Host",{"name":28,"type":22},"ActiveX",{"name":30,"type":31},"Microsoft","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":36,"value":47,"context":48},"CryptoBandits","Name of the malware family",[30,18],{"controls":51,"vendors":126},[52,72,101],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[57,64],{"vendor_slug":58,"vendor_name":30,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":73,"name":74,"problem":75,"products":76},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":102,"name":103,"problem":104,"products":105},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[106,113,119],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":102,"product_name":110,"url":111,"description":112},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":114,"product_name":115,"url":117,"description":118},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":123,"url":124,"description":125},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[127],{"slug":58,"name":30,"logo_path":59,"roles":128},[129],"reported_by",{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":145},"cryptobandits-malware-uses-tor-to-hide-backdoor-and-steal-crypto-funds","CryptoBandits Malware Uses Tor to Hide Backdoor and Steal Crypto Funds","CryptoBandits is a sophisticated Windows-based malware that combines a cryptocurrency clipper with a persistent backdoor, silently replacing wallet addresses to redirect funds to attacker-controlled accounts. By bundling a Tor client and routing command-and-control traffic through a local SOCKS5 proxy, the malware deliberately obscures its network communications, making traditional detection methods ineffective. This dual-purpose design means that even if the clipboard-hijacking behavior is noticed, the backdoor can persist undetected and execute remote commands. The threat highlights how attackers increasingly layer obfuscation techniques to extend dwell time and maximize financial damage. Organizations without robust endpoint monitoring and network egress controls are particularly exposed.",[135,136,137,138,139,140,141,142,143,144],"CIS Control 4 – Secure Configuration of Enterprise Assets","CIS Control 9 – Email and Web Browser Protections (Egress Filtering)","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-53 SI-3 – Malicious Code Protection","NIST SP 800-53 AU-12 – Audit Record Generation","NIST SP 800-53 CM-7 – Least Functionality (Application Allowlisting)","MITRE ATT&CK T1090.003 – Proxy: Multi-hop Proxy (Tor)","MITRE ATT&CK T1115 – Clipboard Data","MITRE ATT&CK T1059 – Command and Scripting Interpreter (Remote Code Execution)",{}]