Miner is a generic label for cryptocurrency-mining malware rather than one distinct family. One operation involved RedTail actors exploiting PAN-OS CVE-2024-3400 and operating private mining pools for greater control; resemblance to Lazarus tactics prompted speculation but not firm attribution. A separate 2017 installer copied intelservice.exe and likely ran XMRig to mine Monero, directing mining traffic or proceeds through port 5615 to a domain belonging to Kim Il Sung University in Pyongyang. These unrelated cases describe different cryptomining operations and do not establish a common malware identity.