Loading story…
Trend Micro reported a Linux cryptomining intrusion tied to CVE-2026-33017 in Langflow that deployed a Bash dropper, isp.sh, and a Go-based ELF payload, lambsys, to mine Monero. The dropper fetched the payload from 83[.]142[.]209[.]214, stored it as /var/tmp/.xlamb, executed it, and established persistence. Researchers said the 2026 lambsys build reflects an actively maintained malware family dating back to at least May 2024, with updated packing, revised C2 communications, and a multistage delivery chain that has helped keep antivirus detection low.
The malware then spread laterally in a worm-like fashion over SSH by reusing credentials and trust material found in ~/.ssh, known_hosts, and SSH agent data, turning single-host compromise into broader exposure across connected Linux systems. Trend Micro said lambsys also killed competing miners, swept mining ports, abused PID files, deleted wallet files and backdoor users such as akay and vfinder, and disabled defenses including the NMI watchdog, ufw, iptables, AppArmor, SELinux, and Alibaba Cloud's aliyun.service; the company warned that incidents involving lambsys should be treated as SSH key exposure events, while noting the tradecraft appears inherited from the older KORKERDS/MALXMR lineage rather than conclusively tied to the same operators.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Trend Micro published analysis of a Linux cryptomining intrusion chain involving the Bash dropper "isp.sh" and the "lambsys" payload. The report described persistence under /var/tmp/.xlamb, SSH-based lateral movement using exposed keys and agent data, and defensive evasion actions including disabling Linux security controls and removing competing miners.
Trend Micro reported that the Go-based ELF payload "lambsys" belongs to a maintained malware family with lineage dating back to at least May 2024. The family has evolved over time with updated packing, revised C2 protocol details, and later multistage delivery changes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TrendAI researchers disclosed **LF3**, an unreported cryptomining and persistence framework targeting internet-exposed Langflow AI-workflow deployments through the `POST /api/v1/validate/code` endpoint. Honeypot telemetry logged 1,180 exploitation requests between May 2025 and July 2026, with LF3 operating across four build channels and producing three successful compromises on two sensors. The activity follows prior exploitation of Langflow’s critical `CVE-2025-3248`, which had been used to deploy the Flodrix botnet. LF3 uses `apt-update[.]com` for custom HTTP command-and-control, installs a shell-based loader, attempts PwnKit privilege escalation, creates layered persistence, and deploys stock XMRig to mine Monero. Researchers cautioned that payloads sent to the code-validation route cannot be reliably assigned to `CVE-2025-3248`, `CVE-2026-0770`, or `CVE-2026-0768` based solely on request structure because the vulnerabilities overlap on that endpoint; defenders should instead hunt for LF3’s C2 protocol and domain, stable configuration schema, hardcoded AES material, and loader artifacts.
Aug 28, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Security researchers detailed multiple Linux malware families that rely on native persistence mechanisms and outbound command-and-control to maintain access on compromised hosts. Intezer analyzed a stripped, statically linked ELF sample it classified as **Reekoobe** through code reuse, finding strings tied to a service named `likemae` and the domain `c[.]linux-hosts[.]com`. In dynamic analysis, the malware renamed itself to `/usr/bin/likemae`, created and enabled `likemae.service` for persistence when run with elevated privileges, and repeatedly attempted DNS lookups and TCP connections to its C2 infrastructure, although the observed port returned `RST,ACK` responses and blocked further interaction. Anomali separately documented the **Linux Rabbit** and **Rabbot** malware strains in a cryptomining campaign that installed Monero miners on Linux servers and IoT devices. Linux Rabbit used Tor hidden services and gateways for C2, persisted through `rc.local` and `.bashrc`, brute-forced SSH credentials, removed competing miners, and deployed architecture-specific miners while also injecting CoinHive scripts into compromised websites; the related Rabbot variant expanded the operation with worm-like propagation, exploitation of known vulnerabilities, and payload delivery over port 80. Together, the reports show Linux threats combining persistence, remote access, propagation, and monetization techniques across servers, web hosts, and embedded devices.
Aug 15, 2026