Loading story…
A Linux-focused botnet used the Tor network and a large proxy infrastructure to conceal command-and-control traffic, deliver payloads, and exfiltrate victim data while deploying the XMRig Monero miner on compromised systems. The malware arrived as a multilayer-encoded shell script, supported multiple Linux architectures, and fetched legitimate utilities such as ss, ps, and curl when they were not already present, indicating an effort to operate flexibly across diverse server environments.
The campaign also abused infrastructure-as-code and cloud management tools including Ansible, Chef, and SaltStack to expand laterally and scale infections. Once active, the malware removed rival cryptominers and disabled or uninstalled cloud monitoring and security agents tied to Tencent Cloud, Alibaba Cloud, and Aegis/YunJing, while researchers found evidence suggesting some Tor proxy and mining-pool servers used in the operation may themselves have been compromised hosts with exposed and vulnerable services.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro researchers David Fiser and Alfredo Oliveira reported a Linux-targeting botnet that used Tor-hosted payload delivery, proxy infrastructure, and infrastructure-as-code tools including Ansible, Chef, and SaltStack for propagation. The malware installed XMRig, disabled cloud security agents, and removed competing miners; the researchers said this was the first case they had observed of Linux malware abusing IaC tools to spread.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Cisco Talos reported a previously unreported Linux botnet dubbed **Xanthe** that targets internet-exposed systems for **Monero** mining, including hosts reachable through SSH and exposed Docker APIs on TCP port `2375`. The malware is modular and deploys **XMRig**, spreading primarily by harvesting client-side SSH keys and known-host data, while also abusing misconfigured Docker environments to gain execution on containerized infrastructure. Once installed, Xanthe uses multiple defense-evasion and persistence techniques to retain control and maximize mining time. Talos said the malware deploys a `libprocesshider` shared object to conceal miner activity, disables security tools, removes competing miners, weakens SSH settings, creates privileged users, installs attacker SSH keys, modifies firewall rules, and persists through cron jobs and `rc.local` changes—behavior consistent with the **Impair Defenses** technique tracked in MITRE ATT&CK as `T1562.001`.
Aug 14, 2026
Researchers linked multiple Linux intrusions to a Romanian-speaking threat cluster that brute-forced weak SSH credentials, compromised servers and network devices at scale, and deployed a Perl-based **Shellbot** with IRC command-and-control. Trend Micro found infrastructure capable of generating target lists covering roughly **80 million IP addresses**, logs indicating more than **65,000 potentially compromised hosts**, and tooling including the **Haiduc** SSH brute-forcer, process-masquerading utility **Faker**, privilege-escalation exploits such as `CVE-2017-16995` and Dirty Cow variants, and high-availability C2 built with CARP. Bitdefender separately tied a likely Romanian group to Linux-focused scanning, SHC-obfuscated loaders, Discord webhook reporting, a customized Perl IRC bot, and a Golang SSH bruteforcer offered in a SaaS-like model, with monetization centered on **Monero** mining via customized **XMRig** payloads. Additional reporting showed the campaign’s tradecraft remained active across traditional servers and cloud-native environments. JPCERT/CC documented attackers using stolen SSH access to move laterally, install **XMRig**, hide mining with **XHide**, tamper with logs, and continue scanning for new SSH targets, while Sysdig observed Shellbot compromise a Tomcat container through brute-forced default credentials, download multi-architecture payloads, establish persistence, erase traces, and receive commands for file transfer, port scanning, data exfiltration, and **DDoS** attacks. Together, the reports describe a long-running Linux-focused operation that blends brute-force access, worm-like propagation, cryptojacking, and botnet functionality across exposed infrastructure.
Aug 15, 2026