๐ฐ TI-2026-025D โ The Economics
Monero, Mining Pools, and the Mathematics of Parasitic Revenue
Chapter 1: The Business Model
Strip away the folklore and the IRC channels and the eight-year persistence and what remains is an economic proposition: convert stolen electricity into cryptocurrency at zero marginal cost.
The mdrfckr botnet is not a ransomware operation demanding payment. It is not a data theft ring selling credentials. It is not a DDoS-for-hire service. It is something simpler and, in its own way, more elegant: a parasitic energy arbitrage. The operator pays nothing for the CPU cycles, nothing for the electricity, nothing for the bandwidth. Every satoshi of revenue is pure profit.
The entire operational overhead is one IRC server at $3.50/month. The rest โ the compromised servers doing the actual mining โ belongs to someone else. Their electricity bills rise by $20-80/month per machine. Their CPU capacity degrades. Their network bandwidth is consumed. And the operator collects the Monero.
Chapter 2: Why Monero
The mdrfckr operation mines exclusively Monero (XMR). Not Bitcoin. Not Ethereum. Not any of the hundreds of alternatives. This choice is not arbitrary โ it is the only rational choice for a parasitic mining operation.
The Technical Argument
Bitcoin mining requires ASICs costing $5,000-15,000 each. Ethereum moved to proof-of-stake. Every other major cryptocurrency requires specialized hardware. Only Monero can be profitably mined on the kind of hardware a botnet controls: general-purpose server CPUs.
The Privacy Argument
483fmPjXKgi9ZzCTMftKcXR4Xyph6B9BGjAnoJGBNHPnbVFe45x1jVm2rs5RanTPGxRzBjwxfaSA1R2sUiHWLFfAG39EwwgCan we track this wallet? No. Monero uses stealth addresses (one-time addresses per transaction), RingCT (ring confidential transactions that hide amounts), and Bulletproofs (range proofs that hide values). Without the private view key, this wallet address reveals nothing โ not the balance, not the transaction history, not the mining pool payouts.
This is precisely why every major cryptojacking operation uses Monero. It is the only cryptocurrency where:
- The wallet balance cannot be queried by law enforcement
- Pool payouts cannot be traced back to specific mining sessions
- Exchange deposits cannot be linked to mining origin
- The total revenue of the operation remains permanently unknown
๐ The Privacy Paradox
Monero's privacy features were designed for legitimate use โ protecting financial privacy in an era of surveillance capitalism. The same features that prevent a government from tracking a dissident's donations also prevent anyone from calculating how much a botnet operator has earned.
This is not a bug in Monero's design. It is a feature that reveals an uncomfortable truth: privacy is indivisible. You cannot build a system that protects political dissidents but not criminals. The math doesn't know the difference.
The mdrfckr operator benefits from the same cryptography that protects journalists in authoritarian regimes. The cost of that protection is that we will never know how much they have earned.
Chapter 3: The XMRig Configuration
The mining software is XMRig โ the most widely used open-source Monero miner. Versions 6.19.0 (Kaspersky observation) and 6.22.1 (Elastic observation) have been documented. Both are UPX-packed ELF binaries with embedded configuration.
Configuration Analysis
| Parameter | Value | Significance |
|---|---|---|
| Algorithm | RandomX (Monero) | CPU-only, no GPU needed |
| Process name | kswapd0 | Mimics Linux kernel thread |
| Background | true | Runs as daemon, no terminal attachment |
| OpenCL/CUDA | Disabled | CPU-only โ avoids GPU detection artifacts |
| Donation | 0% | Removes XMRig's built-in 1% dev fee |
| Pool ports | 80, 4444, 442, Tor | Multiple fallbacks, one over Tor |
| TLS | Mixed (442 = SSL) | Note: port 442, not 443 โ avoids competing with IRC C2 |
| Max threads | All available | Maximizes hashrate at cost of host performance |
Port 442 vs 443: The miner connects to pools on port 442 (one below standard HTTPS). The IRC C2 operates on port 443. This deliberate separation prevents port conflicts on machines where both the miner and the Shellbot run simultaneously. It's a small engineering detail that reveals operational maturity โ the operator has encountered and solved the port collision problem.
The kswapd0 Masquerade
The XMRig binary is renamed to kswapd0 before execution. In Linux, kswapd0 is a legitimate kernel thread responsible for memory page swapping. The real kernel thread appears in process listings as [kswapd0] (with brackets, indicating kernel space). The malware appears as kswapd0 (without brackets, indicating user space).
A system administrator running top or htop will see a process named "kswapd0" consuming 100% of all CPU cores. Unless they know to check for the bracket distinction, they may assume it's a kernel memory management issue rather than a cryptominer. This trick has worked for eight years.
Chapter 4: The Mathematics of Parasitic Mining
Let us calculate what the mdrfckr operation actually earns.
Current Scale (81 Observed Nodes)
Wait. $1.23 per day? For an operation running since 2018? Something doesn't add up.
The Missing Nodes
Our honeypot sees only a fraction of the botnet. The 81 nodes that scanned our single honeypot IP in a 45-day window represent a sample, not a census. Kaspersky (2025) documented infections across multiple continents. Elastic (2025) documented separate incidents. The NINGI researcher operates a different honeypot seeing different nodes. The actual botnet size is estimated at 500-2,000 active nodes at current operational tempo.
Realistic Revenue Estimates
| Scenario | Nodes | Hashrate | Daily XMR | Daily USD | Monthly USD |
|---|---|---|---|---|---|
| Our observation (minimum) | 81 | 56.7 KH/s | 0.008 | $1.23 | $37 |
| Conservative estimate | 500 | 350 KH/s | 0.047 | $7.56 | $227 |
| Moderate estimate | 1,000 | 700 KH/s | 0.095 | $15.12 | $454 |
| High estimate | 2,000 | 1.4 MH/s | 0.189 | $30.24 | $907 |
| Peak (2018, documented) | 180,000 | 126 MH/s | 17.01 | $2,721 | $81,648 |
At moderate estimates: $15/day, $450/month. For Romania, where the average monthly salary is approximately โฌ800-1,200 ($850-1,280), this represents a 35-50% income supplement requiring zero ongoing labor beyond maintaining the C2 server.
Chapter 5: The Energy Theft
The operator pays nothing for electricity. The victims pay everything.
Per-Node Energy Cost
The botnet steals more in electricity than it earns in Monero. At 1,000 nodes, it generates ~$450/month in XMR while stealing $8,640-$18,000/month in electricity. The operator captures less than 5% of the economic damage they inflict. The remaining 95% is pure deadweight loss โ value destroyed without benefit to anyone.
Chapter 6: The Pool Architecture
Mining solo (directly to the Monero blockchain) requires significant hashrate to find blocks consistently. At 700 KH/s, the botnet would wait weeks between block discoveries. Instead, miners connect to mining pools โ cooperatives that combine hashrate and distribute rewards proportionally.
Pool Connection Strategy
The multi-port strategy ensures connectivity from almost any network environment. Corporate firewalls that block port 4444 still allow port 80. Networks that block Tor still allow port 442. The miner will find a path to the pool.
Pool Selection Intelligence
The specific pool addresses are embedded in the UPX-packed binary and require decompression to extract. Published analyses document connections to:
- Major pools (MoneroOcean, Nanopool, SupportXMR) โ high reliability, higher fees (1-2%)
- Tor-enabled pools โ sacrifice speed for privacy
- Private/semi-private pools โ operator-controlled, zero fees, full privacy
๐ The Pool Operator Question
The donation level is set to 0% โ meaning the operator removed XMRig's built-in 1% developer fee. This saves approximately $0.15/day at moderate scale. A trivial amount.
But it raises a question: does the operator run their own mining pool?
A private pool provides maximum privacy (no third-party sees your hashrate), eliminates fees entirely, and prevents pool operators from correlating wallet addresses with IP addresses. The technical skill required to run a basic Monero pool is moderate โ within the capability range of the mdrfckr operator profile.
If the operator runs their own pool, the privacy improvement is significant: no pool operator can be subpoenaed for payout records. The entire chain from CPU to wallet becomes invisible.
Chapter 7: The 2018 Peak โ 180,000 Nodes
In 2018, when Trend Micro first documented Outlaw, the botnet comprised an estimated 180,000 compromised hosts. Let us calculate what that was worth.
2018 Peak
- Nodes: 180,000
- Hashrate: ~126 MH/s
- Network share: ~5-8%
- XMR price (2018 avg): $120
- Daily revenue: $3,000-8,000
- Annual revenue: $1M-3M
2026 Present
- Nodes: ~500-2,000 (estimated)
- Hashrate: ~350 KH/s - 1.4 MH/s
- Network share: ~0.01-0.04%
- XMR price (2026): $160
- Daily revenue: $7-30
- Annual revenue: $2,700-11,000
What Happened Between 2018 and 2026?
The botnet shrunk 99% from peak โ 180,000 to ~1,000 nodes. Revenue dropped from $1M+/year to under $11K/year. And yet the operation continues. Why?
Chapter 8: The Zero-Cost Persistence Theorem
Traditional businesses fail when revenue drops below costs. The mdrfckr operation has costs approaching zero:
The mdrfckr botnet breaks even at 7 nodes. Any number of infected machines above seven generates pure profit. At 81 observed nodes, the operation is profitable. At 1,000 estimated nodes, it's very profitable relative to effort. At 180,000 peak nodes, it was a million-dollar operation.
This is why it never dies. There is no economic pressure to shut down. The operator can lose 99% of their botnet and still be profitable. The only thing that could make this operation unprofitable is losing ALL nodes โ and the SSH key ensures that never happens as long as even a few machines remain unpatched.
Chapter 9: The Victim's Bill
Who actually pays for the mdrfckr operation?
Direct Costs to Victims (Per Infected Host)
| Cost Category | Monthly Impact | Who Pays |
|---|---|---|
| Electricity (CPU at 100%) | $8-18 | Host operator / datacenter |
| CPU capacity loss (performance degradation) | $50-200 (opportunity cost) | Host operator / end users |
| Bandwidth consumption (pool communication) | $1-5 | ISP / host operator |
| Incident response (if detected) | $500-5,000 (one-time) | Organization security team |
| Potential data breach (SSH access persists) | Unquantifiable | Organization / customers |
Aggregate Damage (1,000 nodes, annual)
The ratio is staggering. For every dollar the operator earns, victims collectively lose $50-200. This is perhaps the most economically wasteful form of crime in existence โ destruction-to-profit ratio worse than vandalism, worse than theft, worse than fraud.
Chapter 10: The Monero-to-Cash Pipeline
Mining Monero is one thing. Converting it to spendable currency is another.
Possible Off-Ramp Methods
For a Romanian operator earning $15-30/day, the most likely approach is Method 2 (P2P trades for Romanian lei or euros) combined with Method 4 (holding as savings). The amounts are small enough to avoid triggering exchange compliance alerts and large enough to matter in the Romanian economy.
Chapter 11: The Long Game
If the operator has been mining since 2018, what is the cumulative total?
๐ The Half-Million Dollar Question
If the conservative estimate is correct โ somewhere between $500K and $1.8M in Monero mined over 8 years โ several questions arise:
- Where is the money? In Romania, $500K buys multiple apartments outright. Has the operator accumulated visible wealth? Or are they holding XMR?
- Tax implications: Romania's National Agency for Fiscal Administration (ANAF) taxes cryptocurrency gains at 10%. Has the operator ever declared any of this? Almost certainly not.
- At what scale does law enforcement care? At $50/day, this is below enforcement thresholds. At $500K cumulative, it crosses into organized crime territory in any jurisdiction.
- The holding question: If the operator mined 3,000+ XMR in 2018 and held it, they are sitting on a significant fortune that requires no conversion to have value (Monero is directly spendable). They could be wealthy without ever touching fiat currency.
Chapter 12: The Economic Immunity
The mdrfckr botnet has achieved something unusual in criminal economics: immunity from market forces.
The Perpetual Motion Machine
The mdrfckr botnet is the closest thing to a perpetual motion machine in criminal economics. It consumes no energy from the operator. It requires no ongoing investment. It repairs itself (self-propagation replaces lost nodes). It is resilient to partial destruction. It has survived 8 years of security industry attention.
The operator built this machine once, in 2018, and it has been running ever since. The daily effort required is close to zero โ check the IRC channel occasionally, maybe update a password scheme when researchers get too close. The machine does the rest.
The mdrfckr operation will never stop voluntarily. There is no economic incentive to shut down. There is no technical forcing function. The operator cannot be outcompeted, cannot be bankrupted, and cannot be made unprofitable short of Monero ceasing to exist. The only termination scenarios are: arrest, death, or the operator's voluntary retirement with their accumulated XMR fortune.
Until one of those occurs, the parasite continues. The haiduc rides on.