Loading story…
Threat actors targeted Huawei Cloud Elastic Cloud Service (ECS) instances with an upgraded Linux malware set designed for cryptojacking and broader cloud compromise. The operation deliberately interfered with Huawei Cloud defenses by disabling security-related services such as hostguard and abusing the cloudResetPwdUpdateAgent plugin, indicating environment-specific tradecraft rather than generic Linux opportunism. The attackers also sanitized infected systems by removing competing malware, deleting rival users and SSH keys, creating stealthy privileged accounts, installing Tor, and establishing persistence.
The campaign deployed two main payloads: an obfuscated ELF backdoor, linux64_shell, which used a CrossC2/Cobalt Strike-compatible library to communicate with command-and-control infrastructure, and a Go-based scanner, xlinux, built on the kunpeng framework to spread further. The scanner searched for weak credentials and exploitable services, including Oracle WebLogic systems vulnerable to CVE-2020-14882, underscoring how cloud misconfigurations and poor credential hygiene continued to provide a path for cryptojacking-focused intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research describing a malware campaign that deliberately targets Huawei Cloud Elastic Cloud Service instances for cryptojacking and cloud compromise. The report says the malware disables Huawei Cloud security components, abuses the cloudResetPwdUpdateAgent plugin, deploys a CrossC2-compatible backdoor and a Go-based scanner, and exploits weak credentials and CVE-2020-14882.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Security researchers reported multiple malware operations abusing exposed cloud services and misconfigurations to seize control of Kubernetes and containerized environments. FortiGuard Labs said the **P2PInfect** botnet compromised Google Kubernetes Engine clusters by targeting internet-exposed Redis instances, abusing replication through the `SLAVEOF` command and, in some cases, leveraging `CVE-2022-0543` for remote code execution. The Rust-based malware uses a decentralized peer-to-peer architecture, non-standard ports, and long-lived dormant infections that can persist for months, creating a foothold for later delivery of ransomware, cryptominers, or other payloads. Separate reporting tied the activity to a broader rise in cloud-focused criminal operations that exploit known flaws and weak configurations rather than zero-days. Cyble profiled **TeamPCP** as a large-scale actor targeting Docker APIs, Kubernetes components, Ray dashboards, and Redis to convert victim infrastructure into proxy, command-and-control, ransomware, and Monero mining nodes. Researchers also described a newer framework, **PCPJack**, that appears to piggyback on already compromised cloud environments by wiping TeamPCP artifacts, stealing secrets from AWS, Docker, Kubernetes, GitHub, Slack, Office 365, and other services, and exfiltrating encrypted data to Telegram while spreading worm-like across exposed Docker, Kubernetes, Redis, MongoDB, and RayML services.
Jun 29, 2026
A Linux cloud cryptojacking campaign deployed the **CHAOS RAT** alongside an **XMRig** Monero miner, expanding a typical resource-theft intrusion into a broader remote-access compromise. The infection chain retained common miner tradecraft, including killing competing malware and resource-intensive processes, establishing persistence through `/etc/crontab`, and using Pastebin plus multiple hosting locations to fetch payloads. Researchers said the operators also separated payload delivery infrastructure from command-and-control, with the payload server appearing to be in Russia and the RAT C2 likely geolocated in Hong Kong. The Go-based CHAOS RAT gave attackers capabilities beyond mining, including reverse shell access, file transfer, screenshot capture, system reconnaissance, and host reboot or shutdown. The malware authenticated to its C2 with a hardcoded JSON Web Token supplied at compile time, illustrating a more structured command channel than is typical in basic cryptomining infections. The combination of persistence, miner deployment, and full-featured remote administration showed how Linux cloud-focused threats were evolving from opportunistic cryptojacking into multi-purpose post-compromise operations.
Aug 14, 2026