{"id":44175,"date":"2021-11-29T00:00:00","date_gmt":"2021-11-29T00:00:00","guid":{"rendered":"urn:uuid:1b110ee0-0a06-4b7f-a3ae-004c7dd06cd1"},"modified":"2021-11-29T00:00:00","modified_gmt":"2021-11-29T00:00:00","slug":"campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/","title":{"rendered":"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/21\/k\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/spyagent-main.jpg\"><\/p>\n<div><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/21\/k\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/spyagent-main.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>Finally, we will analyze the two threads. The C&amp;C communication thread regularly makes a GET request to &lt;C&amp;C domain&gt;\/&lt;C&amp;C path&gt;?id=&lt;9digit number&gt;&amp;stat=&lt;environment hash&gt;. The environment hash is computed as an MD5 hash of string created by concatenating the following five values:<\/p>\n<p><span class=\"blockquote\">Value 1 = to_uppercase(crc32(<i>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Cryptography\\MachineGuid<\/i>))<br \/>Value 2 = to_uppercase(crc32(<i>HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProductName<\/i>))<br \/>Value 3 = to_uppercase(crc32(user name))<br \/>Value 4 = to_uppercase(crc32(computer name))<br \/>Value 5 = concatenate Value1 Value2 Value3 Value4<\/span><\/p>\n<p>It might receive a response in the following format:<\/p>\n<p><span class=\"blockquote\">!lexec;&lt;url to download&gt;<br \/>restart<br \/>delproc<\/span><\/p>\n<p>The idleness monitoring thread monitors pressed keys and selecting or dragging movements. If the user is idle for more than one minute, it sends a sidl(start idle) request with the time when the user became idle:<\/p>\n<p><span class=\"blockquote\">&lt;C&amp;C domain&gt;\/&lt;C&amp;C path&gt;?id=&lt;9digit number&gt;&amp;stat=&lt;environment hash&gt;&amp;sidl=&lt;time&gt;<\/span><\/p>\n<p>The length of idleness is then regularly submitted in a cidl (count of idle) parameter:<\/p>\n<p><span class=\"blockquote\">&lt;C&amp;C domain&gt;\/&lt;C&amp;C path&gt;?id=&lt;9digit number&gt;&amp;stat=&lt;environment hash&gt;&amp;cidl=&lt;number of seconds&gt;<\/span><\/p>\n<p>When the user becomes active again, the malware sends an eidl (end of idle) request:<\/p>\n<p><span class=\"blockquote\">&lt;C&amp;C domain&gt;\/&lt;C&amp;C path&gt;?id=&lt;9digit number&gt;&amp;stat=&lt;environment hash&gt;&amp;eidl=&lt;time&gt;&amp;cidl=&lt;number of seconds&gt;<\/span><\/p>\n<p>The idleness monitoring thread allows the malware operator to choose the proper time when the victim is not present in order to stay unnoticed.<\/p>\n<p>SpyAgent usually downloads other malware to perform additional tasks such as stealing important data.<\/p>\n<p>We noticed using SpyAgent downloading the following commodity stealers:<\/p>\n<ul>\n<li><span class=\"rte-red-bullet\">RedLine Stealer<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Ducky stealer<\/span><\/li>\n<li><span class=\"rte-red-bullet\">AZOrult<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Cypress Stealer<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Clipper (a clipboard replacer that replaces various cryptocurrency addresses with those controlled by the malicious actor)<\/span><\/li>\n<\/ul>\n<p>We also noticed other RATS being used in the campaign, such as:<\/p>\n<ul>\n<li><span class=\"rte-red-bullet\">Remcos RAT<br \/><\/span><\/li>\n<li><span class=\"rte-red-bullet\">NanoCore<\/span><\/li>\n<li><span class=\"rte-red-bullet\">njRAT<\/span><\/li>\n<li><span class=\"rte-red-bullet\">AsyncRAT<br \/>&nbsp;<\/span><\/li>\n<\/ul>\n<p>The threat actor behind this malware seems to have a straightforward financial motivation and typically aims to steal credentials and cryptocurrency wallets while also replacing cryptocurrency addresses shared via clipboard.<\/p>\n<p>Fortunately, defending oneself against these attacks is also straightforward. Given the malicious actor\u2019s use of <a href=\"https:\/\/www.trendmicro.com\/vinfo\/us\/security\/definition\/social-engineering\">traditional social engineering techniques<\/a> such as fake websites, malicious advertisements, and spurious social media posts, users should practice due diligence and avoid selecting any suspicious links or visiting dubious websites. We also encourage users to perform security best practices such as bookmarking trusted sites and practicing caution when visiting new websites, especially those that are prone to being abused for social engineering attacks.<\/p>\n<p>The IOCs used in this analysis can be found <a href=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/21\/k\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/ioc-campaign-abusing-legitimate-remote-administrator-tools-uses-fake%20-cyptocurrency-websites.txt\">here<\/a>.<\/p>\n<p> Read More <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/21\/k\/campaign-abusing-rats-uses-fake-websites.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>We have been tracking a campaign involving the SpyAgent malware that abuses well-known remote access tools (RATs) for some time now. While previous versions of the malware have been covered by other researchers, our blog entry focuses on the malicious actor\u2019s latest attacks. Read More HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":44176,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9510,9513,9577,9509],"class_list":["post-44175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trendmicro","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-malware","tag-trend-micro-research-phishing","tag-trend-micro-research-research"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2021-11-29T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/21\/k\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/spyagent-main.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites\",\"datePublished\":\"2021-11-29T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/\"},\"wordCount\":498,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites.jpg\",\"keywords\":[\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Malware\",\"Trend Micro Research : Phishing\",\"Trend Micro Research : Research\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/\",\"name\":\"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites.jpg\",\"datePublished\":\"2021-11-29T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/11\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites.jpg\",\"width\":641,\"height\":350},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : Articles, News, Reports\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-articles-news-reports\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/","og_locale":"en_US","og_type":"article","og_title":"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2021-11-29T00:00:00+00:00","og_image":[{"url":"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/21\/k\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/spyagent-main.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites","datePublished":"2021-11-29T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/"},"wordCount":498,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/11\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites.jpg","keywords":["Trend Micro Research : Articles, News, Reports","Trend Micro Research : Malware","Trend Micro Research : Phishing","Trend Micro Research : Research"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/","url":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/","name":"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/11\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites.jpg","datePublished":"2021-11-29T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/11\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2021\/11\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites.jpg","width":641,"height":350},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/campaign-abusing-legitimate-remote-administrator-tools-uses-fake-cryptocurrency-websites\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : Articles, News, Reports","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-articles-news-reports\/"},{"@type":"ListItem","position":3,"name":"Campaign Abusing Legitimate Remote Administrator Tools Uses Fake Cryptocurrency Websites"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=44175"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/44175\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/44176"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=44175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=44175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=44175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}