Loading story…
Researchers reported a covert Linux cryptomining campaign that gained access through a trusted third-party connection, escalated privileges to root, and then abused Pluggable Authentication Modules (PAM) to move into low-privileged accounts without passwords. The operators reportedly used pam_rootok with su, disabled or suppressed logging, altered authentication records, and planted redundant cron-based persistence across less-monitored user accounts to preserve access and complicate remediation. Group-IB linked the activity to the V25 Generation 26 campaign family.
The payload was described as a heavily modified, self-unlinking XMRig 6.25.0 implant that ran from memory, used /tmp/.lock as a mutex, and spoofed process names such as ssh to evade detection. Researchers said the miner optimized execution with CPU-aware worker spawning, MSR interaction, and Huge Pages, while disguising Stratum mining traffic with a fake Java Agent user agent string to blend into normal network activity. Published indicators included the domain unable[.]download, campaign identifier My-V25-GEN-26, and multiple malware hashes tied to the implant.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Group-IB decoded obfuscated configuration data from the modified, memory-resident XMRig 6.25.0 implant and linked it to the V25 (Generation 26) campaign family. The analysis revealed identifiers and infrastructure including unable.download, My-V25-GEN-26, and the mutex file /tmp/.lock, along with published indicators and hashes.
In May 2026, researchers identified a covert Monero cryptomining campaign targeting Linux systems via a trusted third-party access path, followed by privilege escalation to root. The operators abused PAM, specifically pam_rootok with su, to move into low-privileged accounts and establish redundant cron-based persistence while suppressing logs.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceinfosecurity-magazine.com
Open sourcecybersecuritynews.com
Open sourcegroup-ib.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Researchers detailed Linux-focused cryptojacking operations that compromise internet-exposed systems through **SSH brute-force attacks** and then deploy **XMRig** to mine Monero. One campaign, tracked as **Krane**, was first observed through honeypot activity and used Bash scripts, Python tooling, and ELF binaries to establish persistence, erase and recreate logs, kill rival miners and botnets, and move laterally across additional hosts. Krane operators also used subnet and SYN scanning, SSH banner grabbing, and credential attacks to identify new victims, while infected systems reported discovered targets back to command-and-control infrastructure every 15 seconds. The reporting aligns with broader findings on long-running Linux cryptojacking activity, including the **WatchDog** campaign, which similarly maintained large-scale miner deployments over an extended period. In Krane, analysts linked delivery infrastructure to multiple download servers and network space associated with **AS53667/PONYNET**, observed package variants including `krax` and `ssh`, and tied mining activity to **Hashvault** pools and three Monero wallets. At one point, researchers saw more than 200 active miners and estimated proceeds of roughly **2434.26 EUR**, underscoring how opportunistic SSH compromise and aggressive competitor removal can sustain profitable, persistent cryptomining operations.
Aug 15, 2026
Kaspersky reported that the open-source **XMRig** Monero miner was being folded into broader malware operations, including a "ransominer" chain that monetized victims before any ransom was paid. In one observed intrusion, attackers used a generic Trojan to install administrative tools, create a new user account, enable **RDP** access, deploy **Trojan-Ransom.Win32.Crusis**, and then launch an XMRig loader so the compromised host immediately began generating cryptocurrency for the attackers. Telemetry showed more than **5,000** attempts in August 2020 to install XMRig or modified variants, with **Prometei** and **Cliptomaner** identified as major distributors. Prometei brute-forced **MS SQL** credentials, abused `xp_cmdshell` and **`CVE-2016-0099`**, and used a cross-platform **.NET Core/Apphost** loader to fetch miner payloads for Windows and Linux systems. Cliptomaner, first detected in September 2020, posed as **Realtek** audio software, was written in **AutoIT**, mined cryptocurrency, and also hijacked copied wallet addresses by replacing them with attacker-controlled ones.
Jun 29, 2026