Loading story…
Security researchers detailed multiple Linux malware families that rely on native persistence mechanisms and outbound command-and-control to maintain access on compromised hosts. Intezer analyzed a stripped, statically linked ELF sample it classified as Reekoobe through code reuse, finding strings tied to a service named likemae and the domain c[.]linux-hosts[.]com. In dynamic analysis, the malware renamed itself to /usr/bin/likemae, created and enabled likemae.service for persistence when run with elevated privileges, and repeatedly attempted DNS lookups and TCP connections to its C2 infrastructure, although the observed port returned RST,ACK responses and blocked further interaction.
Anomali separately documented the Linux Rabbit and Rabbot malware strains in a cryptomining campaign that installed Monero miners on Linux servers and IoT devices. Linux Rabbit used Tor hidden services and gateways for C2, persisted through rc.local and .bashrc, brute-forced SSH credentials, removed competing miners, and deployed architecture-specific miners while also injecting CoinHive scripts into compromised websites; the related Rabbot variant expanded the operation with worm-like propagation, exploitation of known vulnerabilities, and payload delivery over port 80. Together, the reports show Linux threats combining persistence, remote access, propagation, and monetization techniques across servers, web hosts, and embedded devices.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Intezer published a technical walkthrough on advanced dynamic analysis of Linux ELF malware, including process inspection, syscall tracing, persistence analysis, and network monitoring, illustrated with the Reekoobe sample.
Anomali Labs published research describing the 2018 Linux Rabbit and Rabbot cryptomining campaign, including its targeting, propagation methods, persistence, and file-hash IOCs.
From September through October 2018, a related self-propagating worm called Rabbot was used in a follow-on campaign. Anomali said Rabbot shared the Linux Rabbit code base and could also target IoT devices by exploiting known vulnerabilities.
Anomali reported that the Linux Rabbit cryptomining campaign began in August 2018, targeting Linux servers in Russia, South Korea, the United Kingdom, and the United States to install Monero miners.
After persistence was established, a service-triggered likemae process was observed running and repeatedly attempting DNS resolution and TCP connections to c[.]linux-hosts[.]com. Network monitoring showed the remote host responded with RST,ACK packets because the target port was closed.
During dynamic analysis with elevated privileges, the malware renamed itself to /usr/bin/likemae, created a likemae.service file, and enabled the service for persistence. The original process then exited after establishing persistence.
Intezer analyzed a real ELF malware sample found in the wild and classified it as Reekoobe based on code reuse from previous samples. Static analysis also identified strings suggesting service-based persistence via the name likemae and a likely C2 domain, c[.]linux-hosts[.]com.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 36 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Researchers linked multiple Linux intrusions to a Romanian-speaking threat cluster that brute-forced weak SSH credentials, compromised servers and network devices at scale, and deployed a Perl-based **Shellbot** with IRC command-and-control. Trend Micro found infrastructure capable of generating target lists covering roughly **80 million IP addresses**, logs indicating more than **65,000 potentially compromised hosts**, and tooling including the **Haiduc** SSH brute-forcer, process-masquerading utility **Faker**, privilege-escalation exploits such as `CVE-2017-16995` and Dirty Cow variants, and high-availability C2 built with CARP. Bitdefender separately tied a likely Romanian group to Linux-focused scanning, SHC-obfuscated loaders, Discord webhook reporting, a customized Perl IRC bot, and a Golang SSH bruteforcer offered in a SaaS-like model, with monetization centered on **Monero** mining via customized **XMRig** payloads. Additional reporting showed the campaign’s tradecraft remained active across traditional servers and cloud-native environments. JPCERT/CC documented attackers using stolen SSH access to move laterally, install **XMRig**, hide mining with **XHide**, tamper with logs, and continue scanning for new SSH targets, while Sysdig observed Shellbot compromise a Tomcat container through brute-forced default credentials, download multi-architecture payloads, establish persistence, erase traces, and receive commands for file transfer, port scanning, data exfiltration, and **DDoS** attacks. Together, the reports describe a long-running Linux-focused operation that blends brute-force access, worm-like propagation, cryptojacking, and botnet functionality across exposed infrastructure.
Aug 15, 2026