Loading story…
Researchers detailed two separate cryptomining botnets targeting large numbers of devices with stealth and persistence features. Palo Alto Networks Unit 42 reported that Eleethub used a malicious Perl shell script to infect Unix-like systems, connect them to IRC-based command-and-control servers, and deploy rootkit components including libprocesshider.so and a modified ps binary to hide mining activity. The malware mined cryptocurrency with XMRig and emech, and also included capabilities for UDP/TCP floods, HTTP attacks, and port scanning, indicating the operators were building a broader botnet that could support disruptive attacks beyond mining.
ESET separately uncovered and helped disrupt VictoryGate, a Monero-mining botnet active since at least 2019 that infected at least 35,000 devices, with more than 90% of victims located in Peru and broader concentration in Latin America. VictoryGate spread mainly through removable USB drives, used AutoIt-based droppers, process injection, and No-IP dynamic DNS subdomains for command and control, and typically monetized infections through XMRig mining. After ESET reported the malicious No-IP subdomains, the provider took them down, cutting off the botnet’s ability to issue new commands or fetch additional payloads, although already infected hosts could continue mining.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
ESET reported that the previously undocumented VictoryGate botnet had been active since at least May 2019. The botnet primarily spread via removable USB drives and monetized infections through Monero mining.
When Unit 42 discovered Eleethub, the botnet appeared to still be under development and only a small number of infected zombies were observed in its Miners channel. The infrastructure included eleethub[.]com and related IRC hosts tied to the campaign.
Unit 42 identified a new Perl shellbot campaign called Eleethub that infected Unix-like systems to mine cryptocurrency and potentially launch DDoS-style attacks. The malware used IRC-based command-and-control and rootkit components including libprocesshider.so and a modified ps binary to hide mining activity.
After ESET reported VictoryGate's malicious No-IP subdomains, No-IP took them down, disrupting the botnet's command-and-control. ESET also shared sinkhole logs with the Shadowserver Foundation to aid remediation, though infected hosts could continue mining.
ESET uncovered a previously undocumented botnet and named it VictoryGate. The researchers assessed it had infected at least 35,000 devices, with infections concentrated in Latin America and more than 90% in Peru.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcecriptonizando.com
Open sourcewelivesecurity.com
Open sourceeset.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Necro** botnet—also tracked as **N3Cr0m0rPh**, **FreakOut**, and **Necromorph**—rapidly evolved from an older Python malware family into an active cross-platform campaign targeting both Linux and Windows systems. Multiple reports tied the operation to exploitation of public-facing flaws including `CVE-2020-28188`, `CVE-2021-3007`, and `CVE-2020-7961`, with later variants adding more n-day exploits such as those affecting TerraMaster, Genexis, Xinuos OpenServer, Zeroshell, and **Visual Tools DVR VX16 4.2.28.0**. The malware also spread through SSH and Telnet brute forcing, and researchers observed infection volumes ranging from hundreds of confirmed download attempts to estimates in the tens of thousands of compromised hosts. The botnet used **IRC-based command and control**, later strengthened with **DGA-generated domains**, **Tor**, **SSL-encrypted communications**, polymorphic code, and PyInstaller-packed binaries to improve resilience and execution. Once installed, Necro enabled **DDoS attacks, reverse shells, persistence, traffic sniffing, ARP poisoning, lateral movement, file infection, and JavaScript injection**, while monetizing access primarily through **XMRig-based Monero mining** and, in some cases, Tezos mining. Cisco Talos also observed a Windows user-mode rootkit and a one-off apparent ransomware delivery attempt, underscoring that the operators were actively adding new payloads and exploit paths as the campaign matured.
Aug 15, 2026
Researchers reported that large-scale botnets continued to spread by abusing known, wormable vulnerabilities and weakly defended internet-facing systems. Proofpoint detailed the **Smominru** operation, a Monero cryptomining botnet that infected more than **526,000 Windows hosts**—likely many of them servers—primarily through the `EternalBlue` SMB flaw (`CVE-2017-0144`), with indications of additional use of `EsteemAudit` (`CVE-2017-0176`) and attacks via SQL Server. The operators were estimated to have mined about **8,900 Monero**, worth roughly **$2.8 million to $3.6 million** at the time, while using Windows Management Instrumentation in an unusual way to support propagation and mining. Separate research highlighted a **Mirai** spreader that introduced additional risk by expanding the malware’s ability to compromise vulnerable devices and propagate further across exposed environments. Together, the reports show threat actors repeatedly monetizing unpatched infrastructure through self-spreading malware, while adapting quickly when defenders disrupt infrastructure, block wallets, or sinkhole command-and-control resources. The activity underscored the operational and financial impact on organizations, including degraded server performance, increased energy costs, and continued exposure from legacy vulnerabilities that remained widely exploitable.
Aug 15, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026