A recent Linux cryptomining campaign has been identified, employing sophisticated techniques to evade detection within compromised networks. Unlike conventional malware, the attackers have repurposed the Pluggable Authentication Modules (PAM) framework—a core component of Linux’s security architecture—to conceal their activities. This approach enables them to mine Monero cryptocurrency while avoiding standard security alerts.
The intrusion commenced in May 2026, when threat actors infiltrated a target network via a trusted third-party connection. After achieving root access—the highest privilege level on a Linux system—the attackers opted for a stealthier strategy. They exploited the pam_rootok policy within the PAM authentication stack, allowing them to switch between low-privileged user accounts without requiring passwords. This method dispersed their activities across accounts that typically receive less scrutiny, effectively creating a forensic smokescreen.
Security researchers from Group-IB uncovered this technique, noting that it enabled the botnet to persist even after the initial root compromise was addressed. The payload used in this campaign is a heavily modified version of the open-source XMRig miner. This variant is designed to erase its own binary from the disk upon execution, operating solely from memory. This fileless execution leaves minimal traces, making it challenging for traditional antivirus tools to detect.
Further complicating detection, the attackers disabled core logging services and manipulated authentication logs on the compromised hosts. This tactic effectively blinded file-based monitoring tools, leaving little forensic evidence on disk. The malware also includes features such as process masquerading—disguising itself as legitimate processes like ‘ssh’—and custom flags for scripted deployment across multiple machines. Additionally, it supports various mining algorithms, including RandomX, CryptoNight, and Argon2, allowing operators to adapt to the most profitable cryptocurrency at any given time.
This campaign underscores a concerning trend where cryptomining operators adopt techniques traditionally associated with advanced persistent threats (APTs). By leveraging trusted components like PAM and employing fileless execution, these attackers demonstrate a high level of sophistication aimed at ensuring the longevity and profitability of their operations.
For organizations, this development highlights the critical need to monitor not just for known malware signatures but also for anomalous behaviors within their networks. Implementing behavioral detection tools and conducting regular audits of authentication mechanisms can help identify and mitigate such stealthy intrusions. As attackers continue to evolve their methods, staying vigilant and proactive in cybersecurity practices becomes increasingly essential.
