Loading story…
Attackers used compromised web hosts at U.S. education organizations to run a cryptojacking operation, sending backdoor commands that downloaded and executed a UPX-packed cpuminer payload. Palo Alto Networks Unit 42 said it observed three incidents in February and March 2021 with the same attack pattern, similar payloads, and consistent targeting of the education sector, indicating likely activity by a single operator.
The malicious HTTP requests looked like webshell or backdoor activity rather than simple exploitation, featuring direct operating-system command execution, disguised or unusual user-agent strings, and in later cases a password parameter. In two incidents, the attacker also fetched a mini shell disguised as wp-load.php, suggesting the compromised directory was exposed to the internet; one mining attempt failed because the algorithm name was misspelled as cpupoer instead of cpupower, while the miner was configured to use wallet-specific cryptocurrency addresses.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
On March 15, 2021, attackers conducted a third related cryptojacking incident against a different U.S. education organization. The activity matched the earlier pattern, including backdoor-style command execution, use of the same miner payload, and download of a disguised mini shell.
On March 10, 2021, Unit 42 observed a second incident against a U.S. education organization using a similar attack pattern and the same cpuminer payload. In this case, the attacker also used a pass parameter and downloaded a mini shell disguised as wp-load.php.
On February 16, 2021, attackers sent backdoor or webshell-style commands to a compromised web host at a U.S. education organization to download and run an UPX-packed cpuminer. The miner execution failed in this incident because the mining algorithm was misspelled as "cpupoer."
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Researchers detailed Linux-focused cryptojacking operations that compromise internet-exposed systems through **SSH brute-force attacks** and then deploy **XMRig** to mine Monero. One campaign, tracked as **Krane**, was first observed through honeypot activity and used Bash scripts, Python tooling, and ELF binaries to establish persistence, erase and recreate logs, kill rival miners and botnets, and move laterally across additional hosts. Krane operators also used subnet and SYN scanning, SSH banner grabbing, and credential attacks to identify new victims, while infected systems reported discovered targets back to command-and-control infrastructure every 15 seconds. The reporting aligns with broader findings on long-running Linux cryptojacking activity, including the **WatchDog** campaign, which similarly maintained large-scale miner deployments over an extended period. In Krane, analysts linked delivery infrastructure to multiple download servers and network space associated with **AS53667/PONYNET**, observed package variants including `krax` and `ssh`, and tied mining activity to **Hashvault** pools and three Monero wallets. At one point, researchers saw more than 200 active miners and estimated proceeds of roughly **2434.26 EUR**, underscoring how opportunistic SSH compromise and aggressive competitor removal can sustain profitable, persistent cryptomining operations.
Aug 15, 2026
Researchers reported a covert Linux cryptomining campaign that gained access through a trusted third-party connection, escalated privileges to root, and then abused Pluggable Authentication Modules (PAM) to move into low-privileged accounts without passwords. The operators reportedly used `pam_rootok` with `su`, disabled or suppressed logging, altered authentication records, and planted redundant cron-based persistence across less-monitored user accounts to preserve access and complicate remediation. Group-IB linked the activity to the **V25 Generation 26** campaign family. The payload was described as a heavily modified, self-unlinking **XMRig 6.25.0** implant that ran from memory, used `/tmp/.lock` as a mutex, and spoofed process names such as `ssh` to evade detection. Researchers said the miner optimized execution with CPU-aware worker spawning, MSR interaction, and Huge Pages, while disguising Stratum mining traffic with a fake **Java Agent** user agent string to blend into normal network activity. Published indicators included the domain `unable[.]download`, campaign identifier `My-V25-GEN-26`, and multiple malware hashes tied to the implant.
Aug 11, 2026