In an intriguing turn of events, a cryptomining operation has been observed adopting novel tactics by relinquishing root access on compromised Linux servers. Instead, the operation has chosen to impersonate low-privileged users, a strategic downgrade that serves to evade the alerts typically generated by root activities within a Security Operations Center (SOC). This new methodology highlights an evolving approach to malicious activity aimed at maximizing stealth and minimizing detection.
Recent research published by Group-IB on July 30 shed light on this alarming trend, particularly involving a mining campaign focused on Monero, a popular cryptocurrency. The campaign was initially identified in May 2026, revealing that the operators had entered a victim network through a trusted relationship with a third-party entity. This breach exemplifies the risks associated with dependency on external vendors, as they can inadvertently open doors for cybercriminals.
Upon breaching a network, the operators swiftly escalated their access privileges to root level. Utilizing the pam_rootok policy within the Linux Pluggable Authentication Modules (PAM), they effortlessly assumed the identities of multiple standard users without needing to bypass password protections. This capability highlights a significant vulnerability in system authentication protocols, offering hackers a clear path to exploit system resources while avoiding detection.
Group-IB characterized this approach as creating a “forensic smokescreen.” By distributing their activities and setting up redundant cron job persistence across less-monitored accounts, the operators effectively obscured their actions. If a network responder attempted to clean up what appeared to be a root compromise, they would invariably find the malware reproducing from these shadowed accounts. Such tactics complicate incident response efforts and enhance the longevity of the threat.
Further obscuring their presence, the attackers disabled core logging services and altered authentication logs. This manipulation resulted in a minimal residual footprint on disk, effectively covering up both the privilege escalation and subsequent PAM manipulations. Their attempts at concealment extended to multiple layers of operations, including process and network management. They implemented a custom flag for process masquerading, which allowed their malware to impersonate legitimate processes like SSH in system listings. This tactic aligns with MITRE technique T1564.013 and showcases an advanced level of sophistication.
In terms of the mining operation itself, the implant utilized in this campaign is a modified version of XMRig 6.25.0. This variant has been cross-compiled using musl libc and integrated a hardcoded banner signifying its status as part of a private botnet. Upon initiation, the malware generates a file-based mutex at /tmp/.lock, ensuring that only a single instance runs at any given time. This measure prevents resource contention, thereby reducing the likelihood of instability that could alert system administrators.
Notably, the mining operation takes an unusual approach by deleting its binary from disk once it is running, thereby migrating entirely into memory. This significant move means that traditional disk scans would present a clean slate, complicating detection efforts further. Once embedded, the malware analyzes the host’s CPU architecture to create worker threads optimized for performance. It accomplishes this by interfacing with kernel model-specific registers (MSR) and allocating Huge Pages to enhance the hashing rate. Additionally, a companion script is employed to eliminate rival mining processes, fortifying the operation’s dominance.
The configuration within the implant is further obscured using layered XOR keys, which, when decrypted, unveil a hardcoded campaign identifier. This indicator links the current operation to a broader family of techniques designed to aggregate hashing power across compromised hosts, underscoring the collective nature of such cryptomining campaigns.
In light of these developments, Group-IB has urged organizations to adopt proactive measures to defend against these types of threats. Recommendations include forwarding logs in real-time to a secure external system resistant to tampering, restricting cross-environment connections from external vendors and clients, and maintaining vigilance for transient artifacts such as the /tmp/.lock mutex. This latter point is especially pertinent, as the malware’s self-unlinking behavior necessitates a focus on memory forensics to uncover its presence before it can cause significant damage.
As the landscape of cyber threats evolves, staying informed and ready to adapt defense mechanisms is crucial in mitigating the risks posed by sophisticated cryptomining operations. The ongoing investigation into these tactics is fundamental to establishing better security protocols and ensuring a more robust defense for vulnerable systems.