From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations

Cybereason Security Services issue Threat Analysis reports to inform on impacting threats. The Threat Analysis reports investigate these threats and provide practical recommendations for protecting against them.

In this Threat Analysis report, Cybereason Security Services investigates the flow of a Tangerine Turkey campaign observed in Cybereason EDR. Tangerine Turkey is a threat actor identified as a visual basic script (VBS) worm used to facilitate cryptomining activity.

KEY points 

• Tangerine Turkey deploys VBScript worms that spread laterally via removable drives(USB).
• The group leverages living-off-the-land binaries (LOLBins) such as wscript.exe and printui.exe for execution and persistence.
• They demonstrate defense‑evasion techniques by modifying registry keys and masquerading malicious binaries as legitimate system files.
• The malware copies malicious files to a newly created mock directory to hide its activity.
• Their primary motivation appears to be financial gain via unauthorized cryptocurrency mining.

Introduction

Tangerine Turkey is a cryptomining campaign leveraging VBScript and batch files to gain persistence, evade defenses, and deploy coin-mining payloads across victim environments. First reported in late 2024, the activity has since expanded globally, targeting organizations indiscriminately across multiple industries and geographies.

Execution Flow of Tangerine Turkey

While not currently associated with ransomware deployment, the actor’s ability to achieve persistence and move laterally poses broader security risks.

TECHNICAL ANALYSIS

This section covers the infection chain of the Tangerine turkey detected by Cybereason EDR. In this particular artifact, the coin-mining payload delivered was XMRig. 

XMRig is primarily a cryptocurrency mining software, designed to mine Monero (XMR) and other cryptocurrencies using a computer’s CPU or GPU. It is open-source and legitimate when used by miners who voluntarily run it. However, malicious actors abuse XMRig for cryptojacking by secretly installing it on compromised machines to mine cryptocurrency for themselves without the owner’s knowledge.

Tactics, Techniques and Procedures (TTPs)  

This section highlights key TTPs seen In this campaign as detected by Cybereason. 

Attack chain as observed in Cybereason EDR

Initial Access via Infected USB 

Initial access in the Tangerine Turkey malware campaign is achieved through an infected USB device. 

The attack begins when the wscript.exe executes a malicious VBScript located on the removal drive. In the observed incident the removable drive was mounted as E:\ (e.g., E:\rootdir\x817994.vbs), although drive letters may vary on different hosts.

This VBScript x817994.vbs serves as the initial dropper, responsible for launching a secondary batch file x966060.bat by spawning cmd.exe.

wscript.exe executes the malicious VBScript from the USB drive:
C:\WINDOWS\System32\WScript.exe E:\rootdir\x817994.vbs

Batch File Execution:
VBScript spawns cmd.exe which runs a batch file:
C:\WINDOWS\system32\cmd.exe /c "E:\rootdir\x966060.bat"

Abuse of LOLBins (printui.exe)

The batch file continues execution by abusing the legitimate Windows binary printui.exe. This living-off-the-land binary (LOLBin) is leveraged to sideload a malicious library svculdr64.dat alongside printui.dll. 

During this stage, user distraction is also attempted. explorer.exe is launched to open the “USB Drive” directory, while xcopy.exe is used to copy both printui.exe and additional payload components (x209791.dat) into the masqueraded System32 directory, ensuring their availability in a trusted location.

xcopy.exe to copy malicious files to newly created directory:
xcopy "C:\Windows\System32\printui.exe" "C:\Windows \System32" /Y
xcopy "x209791.dat" "C:\Windows \System32" /Y

PowerShell Defense Evasion

From there, printui.exe spawns cmd.exe, which executes obfuscated PowerShell commands. The decoded content adds Windows Defender exclusions for the System32 directory, effectively blinding security controls from detecting further activity. This step is a clear defense evasion tactic.

Base64-decoded command → adds Windows Defender exclusions:
Add-MpPreference -ExclusionPath "C:\Windows\System32"

Persistence via Malicious Service

Next, persistence is established by creating a new Windows service x665422. The service is configured to run svchost.exe -k DcomLaunch, while pointing to a malicious service DLL x665422.dat. This ensures the malware will survive system reboots and maintain execution.

Malware creates a new service x665422:
sc create x665422 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto

reg add HKLM\SYSTEM\CurrentControlSet\services\x665422\Parameters /v ServiceDll /d "C:\Windows\System32\x665422.dat" /f
sc start x665422

Payload Execution

The primary payload console_zero.exe is then deployed and executed from the System32 directory. To strengthen persistence, the malware creates a scheduled task named console_zero, configured to run the payload at every user logon with the highest privileges.

Path of the console_zero.exe
C:\Windows\System32\console_zero.exe

Persistence via Scheduled Task
cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f

Cleanup & Anti-Analysis

Finally, the malware attempts cleanup operations by deleting the staging file svculdr64.dat and issuing a command to remove the Windows directory (rmdir /s /q "C:\Windows "). While the latter path manipulation (trailing space) may prevent the actual deletion of the operating system directory, it highlights the malware’s attempt at anti-analysis and destructive behavior.

Attempts to remove evidence:
timeout /t 14 && rmdir /s /q "C:\Windows "
timeout /t 16 && del /q "C:\Windows\System32\svculdr64.dat"

Conclusion

The Tangerine Turkey campaign demonstrates a layered attack strategy using USB‑borne VBScript worms to spread laterally and deploy unauthorized cryptocurrency mining on compromised systems. By leveraging living‑off-the‑land binaries such as wscript.exe and printui.exe, as well as registry modifications and decoy directories, the malware is able to evade traditional defenses and maintain persistence.

The primary impact is financial, through illicit cryptocurrency mining, but the techniques employed also present broader risks, including potential system instability and exposure to additional malware.

Mitigations & Response

Block/limit USB mass-storage: Since the initial infection vector is a USB drive, preventing execution from removable media can block the VBScript dropper before it runs. Organizations can use Group Policy or endpoint controls to disable autorun and limit execution of .vbs or .bat files from external drives. where feasible disable autorun and enforce Device Control.

Application control (AppLocker/WDAC): Tangerine Turkey leverages legitimate Windows binaries such as wscript.exe and printui.exe to execute malicious scripts. Implementing application control or endpoint detection rules for abnormal usage of these binaries can reduce risk and allow early detection.

Harden the registry and monitor changes: The malware uses registry modifications to maintain persistence. Monitoring for unexpected changes in startup keys or known malware persistence locations can alert defenders to ongoing compromise attempts.

Network segmentation and egress filtering: Tangerine Turkey ultimately aims to deploy a cryptocurrency miner, which often communicates with external mining pools. Restricting network traffic from workstations to only authorized endpoints can prevent data exfiltration or miner traffic.

User awareness and USB hygiene: Many infections start via physical access through USB. Educating users to avoid unknown USBs and follow safe insertion policies reduces the likelihood of initial compromise.

About The Researcher 

Mahadev Joshi, Senior Security Analyst, Cybereason Global SOC
Mahadev Joshi is a Security Analyst with the Cybereason Global SOC team. He is passionate about cybersecurity and malware analysis, with a focus on understanding and countering advanced threats. He is  eager to learn more and stay ahead of emerging threats. Mahadev has a Bachelor of science in Information Technology.