“It made just $10 in 2017 mining Monero cryptocurrency, and about $500 in 2018.”
Kaspersky filed StripedFly under bad crypto miners in 2017 and moved on. It was a spy platform that infected more than a million machines, with plug-ins for credentials, files, screenshots and microphone recordings, spread by a custom EternalBlue exploit. The updates came from encrypted archives on GitHub, GitLab and Bitbucket. Making $10 a year was the disguise, and it fooled a top antivirus lab for five years.