Loading story…
Researchers detailed DreamBus, a modular Linux botnet and SystemdMiner variant that has been active since at least 2019, spreading with worm-like behavior across both internet-exposed systems and internal RFC 1918 networks. The malware propagates through SSH trust abuse and brute-force attempts, weak or missing authentication, and exploitation of exposed services including PostgreSQL, Redis, Hadoop YARN, Apache Spark, HashiCorp Consul, and SaltStack. Its operators use TOR-based command-and-control, anonymous file-sharing services, cron persistence, and obfuscated UPX-packed ELF binaries with modified headers to hinder detection.
The botnet’s primary objective is Monero cryptomining using XMRig, but researchers warned the same access and propagation methods could support more destructive activity such as ransomware deployment or data theft. One of the referenced attack surfaces is a SaltStack authorization bypass, aligning with DreamBus’s focus on abusing exposed management services to gain execution on Linux hosts and expand laterally through trusted connections and poorly secured infrastructure.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
Juniper Threat Labs observed DreamBus operators exploiting Apache RocketMQ CVE-2023-33246 against Linux servers, with activity beginning in early June 2023 and payload delivery observed on June 19. The attacks used a bash downloader named reketed to fetch and run the DreamBus ELF binary from TOR infrastructure, ultimately installing the botnet and enabling Monero mining via XMRig.
The botnet's name derives from the TOR command-and-control domain dreambusweduybcp[.]onion, which the report says has been used since July 2019. This domain was part of DreamBus infrastructure for command-and-control.
Zscaler reported that the DreamBus Linux botnet, a SystemdMiner variant, has been active since at least early 2019. The malware spreads in a worm-like manner and is primarily used to deploy XMRig for Monero cryptomining.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 51 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
blogs.juniper.net
Open sourcezscaler.com
Open sourcelabs.f-secure.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Linux-focused botnet used the Tor network and a large proxy infrastructure to conceal command-and-control traffic, deliver payloads, and exfiltrate victim data while deploying the **XMRig** Monero miner on compromised systems. The malware arrived as a multilayer-encoded shell script, supported multiple Linux architectures, and fetched legitimate utilities such as `ss`, `ps`, and `curl` when they were not already present, indicating an effort to operate flexibly across diverse server environments. The campaign also abused infrastructure-as-code and cloud management tools including **Ansible**, **Chef**, and **SaltStack** to expand laterally and scale infections. Once active, the malware removed rival cryptominers and disabled or uninstalled cloud monitoring and security agents tied to **Tencent Cloud**, **Alibaba Cloud**, and **Aegis/YunJing**, while researchers found evidence suggesting some Tor proxy and mining-pool servers used in the operation may themselves have been compromised hosts with exposed and vulnerable services.
Aug 14, 2026
The long-running **Outlaw** (also known as **Dota3**) Linux botnet is compromising internet-exposed systems through opportunistic SSH brute-force attacks, then spreading laterally across reachable subnets. Its payload installs a modified XMRig Monero miner, an IRC-based `STEALTH SHELLBOT` command-and-control component, and the `BLITZ` brute-forcer to locate and compromise additional Linux and potentially IoT devices. Outlaw maintains access through cron jobs and attacker-controlled SSH `authorized_keys`, hides files in locations such as `~/.configrc6`, obfuscates scripts, sets file immutability, and terminates competing mining malware. Honeypot observations also identified manual operator activity for reconnaissance and payload reinstallation; defenders should investigate anomalous SSH authentication attempts, unauthorized cron or SSH-key modifications, hidden or encoded scripts, `socat` usage, suspicious kernel tuning, mining processes, and lateral SSH brute-force traffic.
Sep 9, 2026
Cisco Talos reported a previously unreported Linux botnet dubbed **Xanthe** that targets internet-exposed systems for **Monero** mining, including hosts reachable through SSH and exposed Docker APIs on TCP port `2375`. The malware is modular and deploys **XMRig**, spreading primarily by harvesting client-side SSH keys and known-host data, while also abusing misconfigured Docker environments to gain execution on containerized infrastructure. Once installed, Xanthe uses multiple defense-evasion and persistence techniques to retain control and maximize mining time. Talos said the malware deploys a `libprocesshider` shared object to conceal miner activity, disables security tools, removes competing miners, weakens SSH settings, creates privileged users, installs attacker SSH keys, modifies firewall rules, and persists through cron jobs and `rc.local` changes—behavior consistent with the **Impair Defenses** technique tracked in MITRE ATT&CK as `T1562.001`.
Aug 14, 2026