# Cryptomining Campaign Targeting Linux SSH Servers (XMRig, ShellBot, XHide, Go-based downloaders)

> Attackers compromise internet-exposed Linux SSH servers through dictionary/brute-force attacks on weak credentials, then deploy a multi-stage toolkit (Go downloader and SSH propagation scanner, XMRig miner, Perl ShellBot DDoS bot, XHide process hider, log cleaners). Persistence uses a systemd service and cron jobs; the actor is unknown and activity has been observed since at least 2023.

- **Published:** 2026-11-01T14:29:11Z
- **Last reviewed:** 2026-11-01T14:29:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5000
- **ID:** TL-2026-5000
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Wiz Threat Center and AhnLab ASEC document a persistent cryptomining operation that compromises poorly managed, internet-exposed Linux SSH servers. ASEC observed scanning and login attempts against its SSH honeypots from multiple sources; after a successful dictionary attack the operator installs a toolkit with propagation capability. ASEC assesses that the same threat actors appear to have been carrying out these attacks since at least 2023. Wiz lists the actor as unknown and classifies the impact as resource hijacking (cloud compute cryptojacking). ASEC's earlier reporting on Linux SSH servers (April 2023 'KONO DIO DA' CoinMiner; December 2023 surge in ShellBot/XMRig installs) shows the same broad pattern of SSH dictionary attacks followed by miners and DDoS bots, although the 2023 KONO DIO DA report notes no infrastructure overlap with this XHide/ShellBot toolkit.

Attack flow per ASEC: (1) SSH scanning and brute force against weak credentials; (2) a Go-based downloader named 'run' changes the user's password and fetches a 'pack.jpg' archive from download.xrpl.city (an 'auto.jpg' payload, a '.b0t' ShellBot file and an 'auto/mig' MIG LogCleaner binary are also hosted there); (3) the archive contains the XMRig CoinMiner (a Go-built binary named 'mysql'), a Go propagation/scanner component named 'meta' that is run as './Meta scan ranges 22 -p pass' to scan SSH port 22 across a ranges file using a credential file, a Perl ShellBot (PerlBot, '.b0t') DDoS bot, XHide process hider (h32/h64), and Shc-compiled obfuscation shell scripts (pot, myu, myw); (4) if running as root and not already executing from /etc/ufw/.Dev/oracle-monitor, the malware copies itself to /etc/ufw/.Dev/oracle-monitor and /dev/shm/.Sys_cache_backup and creates the systemd unit /etc/systemd/system/oracle-service.service in watchdog mode, with cron jobs (@reboot /var/tmp/.Sys_cache_<random>) as an additional persistence path; (5) mining begins against four pool IPs plus sad.lat on port 80, and 'meta' reports successful intrusions to youpost.in through an HTTP POST. The miner is configured with a Monero wallet and password 'x'. ASEC also names MIG LogCleaner among the toolkit's log-cleaning utilities.

Defense evasion: the miner masquerades as nine legitimate processes (irqbalance, systemd-logind, dbus-daemon, acpid, systemd-udevd, kworker, systemd-journald, cron, polkitd). The 'pot' script registers .bashrc aliases that mask monitoring commands (w, crontab, top, uptime, ls, lsconfig) and spoofs load average to hide CPU consumption, hides components in dot-directories such as /usr/share/terminfo/c/.X/.L/ and /usr/share/terminfo/c/.X/.X/, and uses lock files /dev/shm/.Agt.Lck (watchdog) and /dev/shm/.Mnr.Lck (miner). ShellBot connects to IRC (irc.lat:80, channel #X, admin X; and an alternate #T3st channel on irc.undernet.org:6667, admin Egeu). Wiz marks the incident entry Finalized (last edited 2026-07-15). No CVEs are involved; initial access depends solely on weak SSH credentials. Note: BeaconBeagle was unreachable at research time (HTTP 403/502), so no C2 correlation was recorded for the network IOCs.

## MITRE ATT&CK

- T1110.001 Password Guessing
- T1078 Valid Accounts
- T1021.004 SSH
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1059 Command and Scripting Interpreter
- T1059.004 Unix Shell
- T1071 Application Layer Protocol
- T1543.002 Systemd Service
- T1053.003 Cron
- T1098 Account Manipulation
- T1685.006 Clear Linux or Mac System Logs
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1496.001 Compute Hijacking

## Sources

- [Cryptomining campaign targeting Linux SSH servers (Wiz Threat Center)](https://threats.wiz.io/all-incidents/cryptomining-campaign-targeting-linux-ssh-servers)
- [Case Study: Distribution of a CoinMiner Targeting Linux SSH Servers (AhnLab ASEC)](https://asec.ahnlab.com/en/94484/)
- [CoinMiner (KONO DIO DA) Distributed to Linux SSH Servers (AhnLab ASEC)](https://asec.ahnlab.com/en/51908/)
- [Обновите свой Linux-сервер: обнаружен рост атак с установкой DDoS-ботов и криптомайнеров (SecurityLab)](https://www.securitylab.ru/news/544895.php)
- [iThome coverage of ASEC Linux SSH CoinMiner report](https://www.ithome.com.tw/news/155012)
- [MITRE ATT&CK T1496.001 Compute Hijacking](https://attack.mitre.org/techniques/T1496/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5000