{
  "family": "idlebuddy",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "PUA:Win32/Idlebuddy is a persistent Potentially Unwanted Program (PUA) that functions primarily as a stealthy **Cryptominer** and distributed computing node. It is designed to hijack the infected endpoint's CPU and GPU resources to mine cryptocurrency (often Monero) for the developers, specifically engineering its execution to only occur when the user is away from the computer to evade detection.<br><br><b>Understanding the Idlebuddy Threat</b><br>To an end-user, Idlebuddy is designed to be invisible. They might occasionally notice the computer's fans spinning loudly when they walk into the room, but the noise stops as soon as they move the mouse. For an enterprise, Idlebuddy represents the theft of computing resources (Cryptojacking), resulting in increased electricity costs, hardware degradation, and severely reduced endpoint lifespan.<br><br><b>Execution and Evasion Mechanics</b><br>Idlebuddy is heavily distributed via software bundlers, often hidden inside installers for free games or utility software (`T1189`). Upon execution, it installs itself deeply into the system, establishing persistence via Registry Run keys or hidden Scheduled Tasks (`T1547.001`). Its defining characteristic is its evasion routine (`T1489`). It utilizes Windows APIs (like `GetLastInputInfo`) to monitor keyboard and mouse activity. The actual mining payload (often a modified version of XMRig) is only launched when the system has been completely idle for a specific duration (e.g., 10 minutes). The moment the user moves the mouse or opens the Task Manager, Idlebuddy instantly suspends or kills the mining process, dropping CPU usage back to normal before the user can see what was causing the lag.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is resource theft and hardware wear. Host-based IoCs include EDR alerts for the creation of processes resembling known cryptominers (e.g., `ib.exe`, `idlebuddy.exe`), or sudden, massive spikes in CPU/GPU utilization that immediately drop when a user logs in. Network IoCs include continuous outbound traffic to known cryptocurrency mining pools (e.g., Stratum protocol traffic) over non-standard ports (like 3333 or 4444) when the machine is locked.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1496",
    "T1489",
    "T1189",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1496",
      "name": "Resource Hijacking (Cryptomining)",
      "tactic": "Impact"
    },
    {
      "id": "T1189",
      "name": "Drive-by Compromise (Bundled Installers)",
      "tactic": "Initial Access"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys",
      "tactic": "Persistence"
    },
    {
      "id": "T1489",
      "name": "Service Stop (Suspending the miner when Task Manager opens)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Use the Windows Control Panel to attempt uninstallation of the software; however, Idlebuddy often uses deceptive uninstallers that leave the mining components behind.",
    "Deploy an enterprise adware/PUA removal tool to locate and strip the hidden scheduled tasks and registry hooks.",
    "Review firewall logs for any endpoints establishing long-lived TCP connections to known cryptocurrency mining pools, and block those IPs at the perimeter.",
    "If the software was installed without administrative privileges, audit the user's `%AppData%` folder for the hidden executables."
  ],
  "what_to_avoid": [
    "Do not rely solely on the Windows Task Manager to find the malware, as its primary evasion tactic is to hide from it.",
    "Avoid ignoring cryptominers; while they don't steal data, the initial access vector that allowed the miner in could be used to deploy ransomware next time."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}