XMRig CoinMiner Campaign Spreads Through Brute-Forced Linux SSH Servers

AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install XMRig-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as ShellBot/PerlBot, MIG LogCleaner, and XHide to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts.

The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including systemd services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.