Linux Cryptomining

Overview

A new Linux cryptomining campaign has emerged, leveraging a rare technique to evade detection: weaponizing the Pluggable Authentication Modules (PAM) framework. By abusing trusted authentication components, attackers concealed their XMRig botnet operations, mining Monero cryptocurrency while bypassing traditional monitoring systems.

Attack Flow

• Initial access: Intrusion via a trusted third‑party connection in May 2026.
• Privilege escalation: Attackers gained root access but avoided detection by impersonating low‑privileged accounts.
• PAM abuse: Exploited pam_rootok policy to switch users without passwords, scattering persistence across accounts.
• Persistence: Cronjobs installed under unmonitored accounts, ensuring the botnet regenerated even after root cleanup.
• Logging evasion: Disabled core logging services and tampered authentication records, blinding forensic tools.

Malware Characteristics

• Customized XMRig miner (based on v6.25.0, cross‑compiled with musl libc).
• Hardcoded banner: “PRIVATE VERSION FOR BOTNET”.
• Fileless execution: Deletes its binary from disk, runs purely in memory.
• Mutex file: /tmp/.lock prevents multiple concurrent instances.
• CPU optimization: Adjusts kernel settings for maximum mining performance.
• Custom flags: Spoofs process names (e.g., ssh) and controls persistence.
• Algorithm support: RandomX, CryptoNight, Argon2.
• Encrypted configuration: XOR keys (I3F0, CLIENT) decode mining pool details.
• Traffic disguise: Uses fake Java Agent strings to blend Stratum traffic into normal web requests.

Indicators of Compromise (IoCs)

• Domain: unable[.]download (mining pool infrastructure).
• Hashes:
  • SHA‑256: 55c67c844258807c4335f40262777a5307bcf5b537c0492cf869b3328796f838.
  • SHA‑1: 88520bcfc741610591a23592f9d4ecb31e34deb5.
  • MD5: 17b60d650fc5d1718d7f2ac3a6075d11.
• File artifact: /tmp/.lock mutex file.

Defensive Guidance

• Audit PAM logs for suspicious root‑to‑user transitions.
• Monitor logging services like rsyslog and auditd for unauthorized changes.
• Use memory forensics to detect implants running purely in memory.
• Restrict third‑party access using zero‑trust principles.
• Inspect cronjobs across all accounts, not just root.

Expert in the Cloud Insight

This campaign demonstrates how cryptomining operators are adopting advanced nation‑state tradecraft. By abusing PAM, disabling logs, and running fileless miners, attackers achieve stealth and persistence once reserved for espionage campaigns. For defenders, the lesson is clear: visibility must extend beyond disk scans and root accounts. Monitoring authentication frameworks and memory activity is now essential to counter modern Linux threats.