Security firm Guardicore has detailed an active malware campaign that has been mining Monero and Vollar since 2018.