The malware is for now using exploits for the Microsoft Exchange “ProxyLogon” security bugs to install Monero-mining malware on targets.