Finding
This article covers captured HTTP request bodies from the selected source cohort. From 2026-11-04 through 2026-11-06 UTC, the cohort contained 130 matching bodies in 130 source-aware sessions, from 3 source IPs across 5 sensors, with 23 exact body variants across 9 route categories.
Daily cohort counts were 34 on 2026-11-04, 45 on 2026-11-05 and 51 on 2026-11-06. The route categories were ASPX: 10; JSP: 15; Velocity-style .vm: 15; /run: 15; /code/blocks/exec/start: 15; /api/v1/code/blocks/exec/start: 15; /code/blocks/exec/code: 15; /api/v1/code/blocks/exec/code: 15; and root route: 15. These extension categories describe requested paths, not a verified vulnerable product.
Evidence in the bodies
The retained bodies carry runtime-specific wrappers for miner setup commands. Of 130 matched requests, 120 contained the Linux initall path and both curl and wget, 90 contained xmrig.pid and kill -0 process checks, and 90 included curl installation through apt-get install. Windows command invocation appeared in 25 requests, and a mining-pool option appeared in 30. Those counts overlap because payloads can branch by operating system.
A repeated wallet value linked requests from 2 of the 3 source IPs. The .configrc6 installation path appeared in Linux and Windows delivery paths. That linkage supports comparing requests across runtime wrappers, while the captured bodies identify mining-tool setup instructions.
Why the mechanism matters
The stronger pivot is the retained mechanism, not a single endpoint name or whole-body hash. Linux paths used initall with curl/wget fallback, and the xmrig.pid plus kill -0 branch checked for an existing process before another launch. Cross-route installation-path and wallet-digest comparison joins related requests that one route rule or exact-body hash would separate.
MITRE ATT&CK describes Resource Hijacking as abuse of co-opted resources for resource-intensive tasks, including cryptocurrency mining. That background fits the captured command-text theme here: runtime-specific wrappers carried miner setup commands, and cross-route comparison of installation paths and wallet digests helped join related requests. Primary-source document
Local hunt
Use this local-only predicate against retained inbound HTTP request bodies. It lowercases one complete body and requires xmrig, either curl or wget, and either .configrc6 or --randomx-mode as literal substring co-occurrence within that same body.
def miner_body(body):
text = body.lower()
return (
'xmrig' in text
and ('curl' in text or 'wget' in text)
and ('.configrc6' in text or '--randomx-mode' in text)
)For matches, group by destination application, route, request time and source. Inspect requested installation paths and compare wallet digests locally. Where host telemetry is available, correlate request time with application child processes and unexpected files. Treat authorized mining labs, replay tests, documentation and approved automation as concrete triage cases by caller, workload owner, requested operation and change record.