Loading story…
Trend Micro reported that the Skidmap malware targets Linux systems with a cryptocurrency-mining payload concealed by rootkit functionality. The malware modifies the operating system at a low level to hide malicious activity, maintain persistence, and evade detection while consuming system resources for illicit mining.
The campaign highlights how Linux-focused threats are combining cryptojacking with stealth techniques more commonly associated with advanced rootkits. By embedding itself deeply in compromised hosts, Skidmap can obscure processes and system changes, making incident response and forensic analysis more difficult for defenders trying to identify and remove the miner.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro released research describing Skidmap, a Linux malware family that uses rootkit capabilities to conceal a cryptocurrency-mining payload on infected systems.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Linux-focused cryptocurrency-mining malware has increasingly targeted servers, cloud workloads, and Docker environments, with attackers abusing the platforms’ reliability, prevalence, and processing power to mine privacy-centric coins such as **Monero**. The activity reflects a broader shift in cryptojacking operations toward Linux systems and exposed applications or APIs that can be leveraged to gain unauthorized access and sustain mining activity. Researchers reported that newer Linux cryptominers are not only designed to consume victim resources but also to detect, disable, and remove rival miners already present on compromised machines, effectively turning infected hosts into contested infrastructure. The behavior mirrors tactics seen in earlier malware families including **KORKERDS** and **Skidmap**, underscoring how cryptojacking campaigns have evolved from simple resource theft into more persistent and competitive operations aimed at monopolizing compromised compute capacity.
Aug 14, 2026
Researchers reported two malware campaigns that install cryptocurrency miners through trojanized downloads delivered from pirate streaming sites and fake software portals. In one operation, users visiting illicit movie and TV sites were shown a bogus video-plugin update that delivered a ZIP archive containing a legitimate executable and a malicious DLL; the DLL sideloaded a multi-stage miner framework with persistence, defense evasion, a watchdog, a **RAT** component, and CPU/GPU mining modules. The malware, a modified fork of SilentCryptoMiner, used DNS tunneling for execution gating, installed a service named `GoogleUpdateTaskMachineQC`, weakened Windows defenses, injected into `conhost.exe` and `explorer.exe`, and communicated through rotating domains and infrastructure tied to `107[.]172[.]212[.]235`. Microsoft described a related cryptojacking-focused campaign aimed at owners of high-performance PCs, using fake downloads of popular utilities and hardware-monitoring tools that were promoted through SEO poisoning and, more recently, surfaced in AI assistant recommendations. Those ZIP archives also paired a legitimate executable with a malicious DLL for sideloading, then installed **ScreenConnect** for persistent remote access, set registry autoruns and scheduled tasks, added Microsoft Defender exclusions, checked for analysis tools, and used process hollowing to launch payloads inside trusted Windows processes. After profiling infected systems, the attackers fetched GPU miners including **gminer**, **lolMiner**, and **SRBMiner-MULTI**; researchers warned the access could support not only cryptomining but also data theft, lateral movement, and eventual ransomware deployment.
Jun 29, 2026
Security researchers detailed multiple Linux malware families that rely on native persistence mechanisms and outbound command-and-control to maintain access on compromised hosts. Intezer analyzed a stripped, statically linked ELF sample it classified as **Reekoobe** through code reuse, finding strings tied to a service named `likemae` and the domain `c[.]linux-hosts[.]com`. In dynamic analysis, the malware renamed itself to `/usr/bin/likemae`, created and enabled `likemae.service` for persistence when run with elevated privileges, and repeatedly attempted DNS lookups and TCP connections to its C2 infrastructure, although the observed port returned `RST,ACK` responses and blocked further interaction. Anomali separately documented the **Linux Rabbit** and **Rabbot** malware strains in a cryptomining campaign that installed Monero miners on Linux servers and IoT devices. Linux Rabbit used Tor hidden services and gateways for C2, persisted through `rc.local` and `.bashrc`, brute-forced SSH credentials, removed competing miners, and deployed architecture-specific miners while also injecting CoinHive scripts into compromised websites; the related Rabbot variant expanded the operation with worm-like propagation, exploitation of known vulnerabilities, and payload delivery over port 80. Together, the reports show Linux threats combining persistence, remote access, propagation, and monetization techniques across servers, web hosts, and embedded devices.
Aug 15, 2026