Kingminer

According to Sophis, the botnet has been active since 2018, initially, the botmasters operated DDoS tools and backdoors, but later moved on to cryptocurrency miners. They use a DGA to automatically change the hosting domains every week.

Family metadata imported from Malpedia (Fraunhofer FKIE).