Loading story…
Researchers reported that the WatchBog cryptomining botnet expanded its tooling beyond Linux-focused exploitation by adding a BlueKeep scanning module that probes RDP services on TCP 3389 for potentially vulnerable Windows hosts. The malware, active since at least 2018, primarily targets unpatched Linux systems and spreads through a Cython-compiled ELF implant that pulls command-and-control data from Pastebin, falls back to a hardcoded .onion service, and communicates over HTTPS without proper certificate validation. That TLS weakness allowed defenders to intercept tasking and victim telemetry, helping estimate roughly 4,500 infections tied to observed infrastructure, though the total may be higher.
Across observed campaigns, WatchBog and related Linux miner activity exploited widely known flaws in Jira, Exim, Solr, Jenkins, Nexus Repository Manager 3, Confluence (CVE-2019-3396), and also abused CouchDB and Redis through brute-force or remote code execution. Once deployed, the operators installed XMRig or XMR-Stak Monero miners, established persistence with cron jobs, moved laterally over SSH using available keys and known_hosts, and in some cases used rootkits or Glibc-hooking libraries to hide processes, files, network traffic, and resource usage. Researchers said the activity underscores continued criminal exploitation of long-patched enterprise software vulnerabilities to build stealthy, self-propagating cryptomining botnets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that threat actors exploited the Confluence widget connector vulnerability CVE-2019-3396 in April 2019 to deliver a Linux cryptocurrency-mining malware chain with a rootkit component.
Atlassian published an advisory in March 2019 covering two critical Confluence vulnerabilities, including CVE-2019-3396.
Intezer reported that the WatchBog cryptomining botnet had been observed as early as November 2018, operating as a Linux-focused malware campaign that spread by exploiting known vulnerabilities.
Cisco Incident Response observed signs that hosts affected by WatchBog became part of a separate botnet around the same time, complicating the operators' claim that they were merely identifying vulnerabilities.
Based on visits to specific Pastebin links, researchers estimated roughly 4,500 infected endpoints tied to WatchBog, while noting the true total was likely higher due to older infrastructure.
Because WatchBog's HTTPS client did not properly validate SSL/TLS certificates, researchers were able to perform a transparent man-in-the-middle interception and decode bot tasking and victim telemetry.
Intezer identified a new BlueKeep scanning module in WatchBog that probed RDP services on TCP 3389 and returned encrypted lists of potentially vulnerable Windows hosts, indicating collection of targets for later use or resale.
Researchers observed an updated WatchBog spreader that added exploit support for Jira, Exim, Solr, Jenkins, and Nexus Repository Manager 3, along with brute-force and RCE capabilities for CouchDB and Redis.
Intezer found that a new WatchBog version rapidly incorporated new propagation capabilities, adding Jira, Solr, and BlueKeep scanner modules within a 13-day period.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
intezer.com
Open sourcealibabacloud.com
Open sourceblog.talosintelligence.com
Open sourceblog.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers linked multiple Linux intrusions to a Romanian-speaking threat cluster that brute-forced weak SSH credentials, compromised servers and network devices at scale, and deployed a Perl-based **Shellbot** with IRC command-and-control. Trend Micro found infrastructure capable of generating target lists covering roughly **80 million IP addresses**, logs indicating more than **65,000 potentially compromised hosts**, and tooling including the **Haiduc** SSH brute-forcer, process-masquerading utility **Faker**, privilege-escalation exploits such as `CVE-2017-16995` and Dirty Cow variants, and high-availability C2 built with CARP. Bitdefender separately tied a likely Romanian group to Linux-focused scanning, SHC-obfuscated loaders, Discord webhook reporting, a customized Perl IRC bot, and a Golang SSH bruteforcer offered in a SaaS-like model, with monetization centered on **Monero** mining via customized **XMRig** payloads. Additional reporting showed the campaign’s tradecraft remained active across traditional servers and cloud-native environments. JPCERT/CC documented attackers using stolen SSH access to move laterally, install **XMRig**, hide mining with **XHide**, tamper with logs, and continue scanning for new SSH targets, while Sysdig observed Shellbot compromise a Tomcat container through brute-forced default credentials, download multi-architecture payloads, establish persistence, erase traces, and receive commands for file transfer, port scanning, data exfiltration, and **DDoS** attacks. Together, the reports describe a long-running Linux-focused operation that blends brute-force access, worm-like propagation, cryptojacking, and botnet functionality across exposed infrastructure.
Aug 15, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Researchers detailed Linux-focused cryptojacking operations that compromise internet-exposed systems through **SSH brute-force attacks** and then deploy **XMRig** to mine Monero. One campaign, tracked as **Krane**, was first observed through honeypot activity and used Bash scripts, Python tooling, and ELF binaries to establish persistence, erase and recreate logs, kill rival miners and botnets, and move laterally across additional hosts. Krane operators also used subnet and SYN scanning, SSH banner grabbing, and credential attacks to identify new victims, while infected systems reported discovered targets back to command-and-control infrastructure every 15 seconds. The reporting aligns with broader findings on long-running Linux cryptojacking activity, including the **WatchDog** campaign, which similarly maintained large-scale miner deployments over an extended period. In Krane, analysts linked delivery infrastructure to multiple download servers and network space associated with **AS53667/PONYNET**, observed package variants including `krax` and `ssh`, and tied mining activity to **Hashvault** pools and three Monero wallets. At one point, researchers saw more than 200 active miners and estimated proceeds of roughly **2434.26 EUR**, underscoring how opportunistic SSH compromise and aggressive competitor removal can sustain profitable, persistent cryptomining operations.
Aug 15, 2026