Threat reportMalwareTL-2026-5000
Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders)
Cryptomining Campaign Targeting Linux SSH Servers (XMRig (TL-2026-5000) is a medium-severity malware campaign, first published 2026-11-01. It has no confirmed attribution, affects Various Internet-exposed Linux servers running SSH with weak or, maps to 16 MITRE ATT&CK techniques (T1021.004, T1027, T1036.005), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-5000
- Threat ID
- TL-2026-5000
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cloud, hosting
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Cryptomining Campaign Targeting Linux SSH Servers (XMRig
Malware and tooling: PerlBot, xmrig
How Cryptomining Campaign Targeting Linux SSH Servers (XMRig works
Attackers compromise internet-exposed Linux SSH servers through dictionary/brute-force attacks on weak credentials, then deploy a multi-stage toolkit (Go downloader and SSH propagation scanner, XMRig miner, Perl ShellBot DDoS bot, XHide process hider, log cleaners). Persistence uses a systemd service and cron jobs; the actor is unknown and activity has been observed since at least 2023.
Wiz Threat Center and AhnLab ASEC document a persistent cryptomining operation that compromises poorly managed, internet-exposed Linux SSH servers. ASEC observed scanning and login attempts against its SSH honeypots from multiple sources; after a successful dictionary attack the operator installs a toolkit with propagation capability. ASEC assesses that the same threat actors appear to have been carrying out these attacks since at least 2023. Wiz lists the actor as unknown and classifies the impact as resource hijacking (cloud compute cryptojacking). ASEC's earlier reporting on Linux SSH servers (April 2023 'KONO DIO DA' CoinMiner; December 2023 surge in ShellBot/XMRig installs) shows the same broad pattern of SSH dictionary attacks followed by miners and DDoS bots, although the 2023 KONO DIO DA report notes no infrastructure overlap with this XHide/ShellBot toolkit.
Attack flow per ASEC: (1) SSH scanning and brute force against weak credentials; (2) a Go-based downloader named 'run' changes the user's password and fetches a 'pack.jpg' archive from download.xrpl.city (an 'auto.jpg' payload, a '.b0t' ShellBot file and an 'auto/mig' MIG LogCleaner binary are also hosted there); (3) the archive contains the XMRig CoinMiner (a Go-built binary named 'mysql'), a Go propagation/scanner component named 'meta' that is run as './Meta scan ranges 22 -p pass' to scan SSH port 22 across a ranges file using a credential file, a Perl ShellBot (PerlBot, '.b0t') DDoS bot, XHide process hider (h32/h64), and Shc-compiled obfuscation shell scripts (pot, myu, myw); (4) if running as root and not already executing from /etc/ufw/.Dev/oracle-monitor, the malware copies itself to /etc/ufw/.Dev/oracle-monitor and /dev/shm/.Sys_cache_backup and creates the systemd unit /etc/systemd/system/oracle-service.service in watchdog mode, with cron jobs (@reboot /var/tmp/.Sys_cache_<random>) as an additional persistence path; (5) mining begins against four pool IPs plus sad.lat on port 80, and 'meta' reports successful intrusions to youpost.in through an HTTP POST. The miner is configured with a Monero wallet and password 'x'. ASEC also names MIG LogCleaner among the toolkit's log-cleaning utilities.
Defense evasion: the miner masquerades as nine legitimate processes (irqbalance, systemd-logind, dbus-daemon, acpid, systemd-udevd, kworker, systemd-journald, cron, polkitd). The 'pot' script registers .bashrc aliases that mask monitoring commands (w, crontab, top, uptime, ls, lsconfig) and spoofs load average to hide CPU consumption, hides components in dot-directories such as /usr/share/terminfo/c/.X/.L/ and /usr/share/terminfo/c/.X/.X/, and uses lock files /dev/shm/.Agt.Lck (watchdog) and /dev/shm/.Mnr.Lck (miner). ShellBot connects to IRC (irc.lat:80, channel #X, admin X; and an alternate #T3st channel on irc.undernet.org:6667, admin Egeu). Wiz marks the incident entry Finalized (last edited 2026-07-15). No CVEs are involved; initial access depends solely on weak SSH credentials. Note: BeaconBeagle was unreachable at research time (HTTP 403/502), so no C2 correlation was recorded for the network IOCs.
MITRE ATT&CK techniques used in TL-2026-5000
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hidden Files and Directories
Discovery
T1046 Network Service Discovery; T1082 System Information Discovery
Persistence
T1053.003 Cron; T1098 Account Manipulation; T1543.002 Systemd Service
Execution
T1059 Command and Scripting Interpreter; T1059.004 Unix Shell
Command and Control
T1071 Application Layer Protocol
Initial Access
Credential Access
Impact
defense-impairment
Affected products and versions in Cryptomining Campaign Targeting Linux SSH Servers (XMRig
- Various — Internet-exposed Linux servers running SSH with weak or guessable credentials
Vulnerable versions: Any Linux host allowing SSH password authentication with weak credentials
Remediation for Cryptomining Campaign Targeting Linux SSH Servers (XMRig
Immediate actions
- Hunt for /etc/systemd/system/oracle-service.service, /etc/ufw/.Dev/oracle-monitor, /dev/shm/.Sys_cache_backup, /dev/shm/.Agt.Lck, /dev/shm/.Mnr.Lck, /var/tmp/.Sys_cache_* and /usr/share/terminfo/c/.X/
- Block outbound connections to the listed domains, URLs and IPs, and egress IRC (TCP 6667) where not required
- Rotate credentials for any account that authenticated successfully from untrusted sources; the malware changes user passwords
- Review shell profiles (.bashrc) for aliases overriding top, uptime, w, ls and crontab, and inspect cron entries for unknown @reboot jobs
Workarounds
- Enforce strong, unique passwords and disable root SSH login until password authentication is removed
Longer-term hardening
- Disable SSH password authentication and require key-based authentication or MFA
- Restrict SSH exposure to the internet using allow-lists, VPN or bastion hosts
- Deploy fail2ban or equivalent rate limiting and monitor for SSH brute-force patterns
- Monitor for unexpected systemd unit creation and sustained high CPU usage on servers
Weaknesses (CWE) in Cryptomining Campaign Targeting Linux SSH Servers (XMRig
Timeline of Cryptomining Campaign Targeting Linux SSH Servers (XMRig
- Earliest point of activity: ASEC and Wiz state the campaign has been active since 'at least 2023' (year-level statement only; 1 January is a placeholder for the year, no exact date is published)
- AhnLab ASEC publishes the 'KONO DIO DA' CoinMiner report on SSH dictionary attacks against Linux servers (XMRig, SHC-compiled scripts, cron persistence); earlier related activity, no infrastructure overlap with this toolkit
- ASEC reporting (relayed by SecurityLab) describes a surge in SSH brute-force attacks on poorly managed Linux servers installing ShellBot, Tsunami and ChinaZ DDoS bots and XMRig miners
- Wiz Threat Center publishes the incident entry classifying the campaign as SSH brute-force driven resource hijacking by an unknown actor
- AhnLab ASEC publishes case study describing the CoinMiner distribution chain against Linux SSH servers (run downloader, meta scanner, XMRig, ShellBot, XHide, MIG LogCleaner) and assesses the same actors have operated since at least 2023
- Wiz last edits the incident entry and marks it Finalized
Sources cited for Cryptomining Campaign Targeting Linux SSH Servers (XMRig
- Cryptomining campaign targeting Linux SSH servers (Wiz Threat Center)
- Case Study: Distribution of a CoinMiner Targeting Linux SSH Servers (AhnLab ASEC)
- CoinMiner (KONO DIO DA) Distributed to Linux SSH Servers (AhnLab ASEC)
- Обновите свой Linux-сервер: обнаружен рост атак с установкой DDoS-ботов и криптомайнеров (SecurityLab)
- iThome coverage of ASEC Linux SSH CoinMiner report
- MITRE ATT&CK T1496.001 Compute Hijacking
Detection coverage for TL-2026-5000
As of 2026-11-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5000 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.