Linux Malware Campaign Targets Huawei Cloud ECS for Cryptojacking

Threat actors targeted Huawei Cloud Elastic Cloud Service (ECS) instances with an upgraded Linux malware set designed for cryptojacking and broader cloud compromise. The operation deliberately interfered with Huawei Cloud defenses by disabling security-related services such as hostguard and abusing the cloudResetPwdUpdateAgent plugin, indicating environment-specific tradecraft rather than generic Linux opportunism. The attackers also sanitized infected systems by removing competing malware, deleting rival users and SSH keys, creating stealthy privileged accounts, installing Tor, and establishing persistence.

The campaign deployed two main payloads: an obfuscated ELF backdoor, linux64_shell, which used a CrossC2/Cobalt Strike-compatible library to communicate with command-and-control infrastructure, and a Go-based scanner, xlinux, built on the kunpeng framework to spread further. The scanner searched for weak credentials and exploitable services, including Oracle WebLogic systems vulnerable to CVE-2020-14882, underscoring how cloud misconfigurations and poor credential hygiene continued to provide a path for cryptojacking-focused intrusions.