Loading story…
Wiz Research attributed an evolved Linux malware campaign to the Romanian-speaking Diicot group, also known as Mexals. The operators compromise OpenSSH-exposed hosts using weak credentials, deploy an Update payload for persistence, establish reverse-shell access, and scan and brute-force additional SSH targets to propagate across environments. The activity follows the previously documented resurgence of the Mexals cryptojacking operation.
The malware creates cron-based persistence, allowing payloads to execute repeatedly or after system restart—a common Unix persistence technique tracked as MITRE ATT&CK T1053.003. Diicot differentiates cloud-associated Linux distributions from other systems, focusing propagation efforts on cloud environments while deploying customized XMRig-based Monero miners on non-cloud hosts. The campaign also uses HTTP command-and-control, rapidly rotated infrastructure, staged payloads, and modified UPX headers and checksums to hinder analysis; researchers linked it to more than $16,000 in Monero revenue and suspected additional Zephyr Protocol mining activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
A new version of the abc123 payload, containing a custom XMRig-based miner and embedded Update payload, was uploaded on December 5, 2024.
The latest Diicot infrastructure was first observed around October 12, 2024.
Researchers identified 91.92.250[.]6 as a likely Diicot payload server that was active from May 1 through September 26, 2024.
Wiz Research attributed an evolved Linux malware campaign to the Romanian-speaking Diicot group, also known as Mexals. The operation compromises OpenSSH-exposed Linux systems using weak credentials, establishes cron persistence, propagates through SSH brute forcing, and deploys cryptomining payloads on non-cloud systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 27 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
wiz.io
Open sourceakamai.com
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Researchers linked multiple Linux intrusions to a Romanian-speaking threat cluster that brute-forced weak SSH credentials, compromised servers and network devices at scale, and deployed a Perl-based **Shellbot** with IRC command-and-control. Trend Micro found infrastructure capable of generating target lists covering roughly **80 million IP addresses**, logs indicating more than **65,000 potentially compromised hosts**, and tooling including the **Haiduc** SSH brute-forcer, process-masquerading utility **Faker**, privilege-escalation exploits such as `CVE-2017-16995` and Dirty Cow variants, and high-availability C2 built with CARP. Bitdefender separately tied a likely Romanian group to Linux-focused scanning, SHC-obfuscated loaders, Discord webhook reporting, a customized Perl IRC bot, and a Golang SSH bruteforcer offered in a SaaS-like model, with monetization centered on **Monero** mining via customized **XMRig** payloads. Additional reporting showed the campaign’s tradecraft remained active across traditional servers and cloud-native environments. JPCERT/CC documented attackers using stolen SSH access to move laterally, install **XMRig**, hide mining with **XHide**, tamper with logs, and continue scanning for new SSH targets, while Sysdig observed Shellbot compromise a Tomcat container through brute-forced default credentials, download multi-architecture payloads, establish persistence, erase traces, and receive commands for file transfer, port scanning, data exfiltration, and **DDoS** attacks. Together, the reports describe a long-running Linux-focused operation that blends brute-force access, worm-like propagation, cryptojacking, and botnet functionality across exposed infrastructure.
Aug 15, 2026
Security researchers detailed multiple Linux malware families that rely on native persistence mechanisms and outbound command-and-control to maintain access on compromised hosts. Intezer analyzed a stripped, statically linked ELF sample it classified as **Reekoobe** through code reuse, finding strings tied to a service named `likemae` and the domain `c[.]linux-hosts[.]com`. In dynamic analysis, the malware renamed itself to `/usr/bin/likemae`, created and enabled `likemae.service` for persistence when run with elevated privileges, and repeatedly attempted DNS lookups and TCP connections to its C2 infrastructure, although the observed port returned `RST,ACK` responses and blocked further interaction. Anomali separately documented the **Linux Rabbit** and **Rabbot** malware strains in a cryptomining campaign that installed Monero miners on Linux servers and IoT devices. Linux Rabbit used Tor hidden services and gateways for C2, persisted through `rc.local` and `.bashrc`, brute-forced SSH credentials, removed competing miners, and deployed architecture-specific miners while also injecting CoinHive scripts into compromised websites; the related Rabbot variant expanded the operation with worm-like propagation, exploitation of known vulnerabilities, and payload delivery over port 80. Together, the reports show Linux threats combining persistence, remote access, propagation, and monetization techniques across servers, web hosts, and embedded devices.
Aug 15, 2026