Loading story…
Attackers exploited multiple publicly disclosed pre-authentication vulnerabilities in internet-exposed enterprise products to install Monero-mining malware on both Windows and Linux systems. Observed targets included Apache HTTP Server, Atlassian Confluence, F5 BIG-IP, VMware vCenter, and Oracle WebLogic Server, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms GitHub and Netlify to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed.
On Windows, the malware used batch scripts to profile infected hosts, download XMRig and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with nohup. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Trend Micro notified GitHub and Netlify about the malicious activity, and both platforms took down the attacker accounts hosting the mining infrastructure. This disrupted the campaign's use of legitimate hosting services.
The campaign abused GitHub and Netlify as distribution points for malicious scripts, miner binaries, and configuration files. Trend Micro reported Windows batch scripts and Linux shell scripts downloading XMRig-related payloads and configs from attacker-controlled repositories and CDN locations.
Trend Micro observed in-the-wild exploitation attempts using pre-authentication vulnerabilities in products including Apache HTTP Server, Atlassian Confluence, F5 BIG-IP, VMware vCenter, and Oracle WebLogic Server to deploy Monero-mining malware. The malware targeted both Windows and Linux systems.
The Apache HTTP Server Project released official fixes for CVE-2021-41773 and the bypass issue tracked as CVE-2021-42013. These vulnerabilities were later among those exploited in the mining campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers built a cryptojacking botnet by exploiting **`CVE-2017-7269`**, a WebDAV buffer overflow in unpatched **Microsoft IIS 6.0** servers running on **Windows Server 2003**. The campaign, active since at least May 2017, used internet-wide scanning from **Amazon Web Services-hosted IP addresses** to find vulnerable systems and then delivered shellcode that downloaded and executed a minimally modified version of the open-source **`xmrig`** miner. The compromised servers were used to mine **Monero**, with the operation reportedly growing to several hundred machines and generating more than **420 XMR**, worth over **$63,000** at the time. ESET said it detected the miner as **`Win32/CoinMiner.AMW`** and the exploit traffic as **`webDAV/ExplodingCan`**, and urged administrators to apply Microsoft patch **`KB3197835`** and other critical updates to protect exposed legacy servers.
Aug 14, 2026
Researchers detailed Linux-focused cryptojacking operations that compromise internet-exposed systems through **SSH brute-force attacks** and then deploy **XMRig** to mine Monero. One campaign, tracked as **Krane**, was first observed through honeypot activity and used Bash scripts, Python tooling, and ELF binaries to establish persistence, erase and recreate logs, kill rival miners and botnets, and move laterally across additional hosts. Krane operators also used subnet and SYN scanning, SSH banner grabbing, and credential attacks to identify new victims, while infected systems reported discovered targets back to command-and-control infrastructure every 15 seconds. The reporting aligns with broader findings on long-running Linux cryptojacking activity, including the **WatchDog** campaign, which similarly maintained large-scale miner deployments over an extended period. In Krane, analysts linked delivery infrastructure to multiple download servers and network space associated with **AS53667/PONYNET**, observed package variants including `krax` and `ssh`, and tied mining activity to **Hashvault** pools and three Monero wallets. At one point, researchers saw more than 200 active miners and estimated proceeds of roughly **2434.26 EUR**, underscoring how opportunistic SSH compromise and aggressive competitor removal can sustain profitable, persistent cryptomining operations.
Aug 15, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026