Cryptomining Botnets Eleethub and VictoryGate Infected Thousands of Systems

Researchers detailed two separate cryptomining botnets targeting large numbers of devices with stealth and persistence features. Palo Alto Networks Unit 42 reported that Eleethub used a malicious Perl shell script to infect Unix-like systems, connect them to IRC-based command-and-control servers, and deploy rootkit components including libprocesshider.so and a modified ps binary to hide mining activity. The malware mined cryptocurrency with XMRig and emech, and also included capabilities for UDP/TCP floods, HTTP attacks, and port scanning, indicating the operators were building a broader botnet that could support disruptive attacks beyond mining.

ESET separately uncovered and helped disrupt VictoryGate, a Monero-mining botnet active since at least 2019 that infected at least 35,000 devices, with more than 90% of victims located in Peru and broader concentration in Latin America. VictoryGate spread mainly through removable USB drives, used AutoIt-based droppers, process injection, and No-IP dynamic DNS subdomains for command and control, and typically monetized infections through XMRig mining. After ESET reported the malicious No-IP subdomains, the provider took them down, cutting off the botnet’s ability to issue new commands or fetch additional payloads, although already infected hosts could continue mining.