Loading story…
The Rocke Group deployed Pro-Ocean, a cloud-focused cryptojacking malware family designed to mine Monero while improving stealth, persistence, and worm-like propagation across compromised environments. Palo Alto Networks Unit 42 reported that the malware targets vulnerable services including Apache ActiveMQ via CVE-2016-3088, Oracle WebLogic via CVE-2017-10271, and unsecured Redis instances, with notable focus on Alibaba Cloud and Tencent Cloud deployments. Written in Go, Pro-Ocean hides an embedded XMRig miner behind multiple obfuscation layers and organizes its activity into four modules: hiding, mining, infecting, and watchdog.
The malware’s hiding module abuses LD_PRELOAD and /etc/ld.so.preload to conceal files and processes, while the infection module scans local subnets and uses public exploits to spread laterally. Its installation routine removes competing malware and miners, disables iptables, attempts SSH-key-based movement between systems, and uninstalls cloud monitoring agents associated with Tencent Cloud and Alibaba Cloud. A watchdog component maintains persistence and kills high-CPU processes so the miner can maximize resource consumption on infected hosts.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Unit 42 had previously documented cloud-targeted malware used by the Rocke Group for Monero cryptojacking. The reference explicitly anchors this earlier reporting to 2019.
Cisco Talos published research on the Rocke group's Monero-mining operations, documenting the threat actor's activity before the later 2019 and subsequent variant reports already in the timeline.
Intezer reported on a Rocke Group Linux/cloud cryptojacking malware variant that spreads laterally using saved SSH keys from known_hosts, brute-forces SSH, Redis, and Jenkins, and exploits Jenkins and ActiveMQ flaws. The report also detailed persistence via cron, bashrc, and a systemd service, plus DNS-over-HTTPS C2 resolution and XMRig miner deployment.
Unit 42 identified Pro-Ocean as a revised version of the Rocke Group’s cloud-targeted cryptojacking malware. The new variant adds stronger rootkit and worm capabilities and targets vulnerable cloud applications and unsecured Redis instances, with emphasis on Alibaba Cloud and Tencent Cloud environments.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
intezer.com
Open sourceunit42.paloaltonetworks.com
Open sourcefortinet.com
Open sourceblog.talosintelligence.com
Open sourcejenkins.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
A Linux cloud cryptojacking campaign deployed the **CHAOS RAT** alongside an **XMRig** Monero miner, expanding a typical resource-theft intrusion into a broader remote-access compromise. The infection chain retained common miner tradecraft, including killing competing malware and resource-intensive processes, establishing persistence through `/etc/crontab`, and using Pastebin plus multiple hosting locations to fetch payloads. Researchers said the operators also separated payload delivery infrastructure from command-and-control, with the payload server appearing to be in Russia and the RAT C2 likely geolocated in Hong Kong. The Go-based CHAOS RAT gave attackers capabilities beyond mining, including reverse shell access, file transfer, screenshot capture, system reconnaissance, and host reboot or shutdown. The malware authenticated to its C2 with a hardcoded JSON Web Token supplied at compile time, illustrating a more structured command channel than is typical in basic cryptomining infections. The combination of persistence, miner deployment, and full-featured remote administration showed how Linux cloud-focused threats were evolving from opportunistic cryptojacking into multi-purpose post-compromise operations.
Aug 14, 2026
Threat actors targeted **Huawei Cloud Elastic Cloud Service (ECS)** instances with an upgraded Linux malware set designed for cryptojacking and broader cloud compromise. The operation deliberately interfered with Huawei Cloud defenses by disabling security-related services such as **hostguard** and abusing the `cloudResetPwdUpdateAgent` plugin, indicating environment-specific tradecraft rather than generic Linux opportunism. The attackers also sanitized infected systems by removing competing malware, deleting rival users and SSH keys, creating stealthy privileged accounts, installing **Tor**, and establishing persistence. The campaign deployed two main payloads: an obfuscated ELF backdoor, `linux64_shell`, which used a **CrossC2/Cobalt Strike-compatible** library to communicate with command-and-control infrastructure, and a Go-based scanner, `xlinux`, built on the **kunpeng** framework to spread further. The scanner searched for weak credentials and exploitable services, including **Oracle WebLogic** systems vulnerable to `CVE-2020-14882`, underscoring how cloud misconfigurations and poor credential hygiene continued to provide a path for cryptojacking-focused intrusions.
Aug 14, 2026