Linux Cryptomining Campaign Leverages PAM for Stealthy XMRig Botnet Operations
A sophisticated Linux cryptomining campaign is employing the Pluggable Authentication Modules (PAM) framework to obscure its XMRig botnet activities, creating a significant challenge for detection and forensics.
A novel Linux cryptomining campaign has emerged, utilizing a sophisticated technique to evade detection by weaponizing the trusted Pluggable Authentication Modules (PAM) framework. Threat actors gained initial root access to target systems starting in May 2026, often through a compromised third-party connection. Instead of maintaining overt root privileges, which typically trigger security alerts, the attackers pivoted to a more clandestine approach.
This campaign's core innovation lies in its abuse of PAM to impersonate low-privileged users without requiring passwords. Researchers from Group-IB identified this tactic, noting that it allows the botnet to persist even after the initial root compromise is remediated. By spreading malicious cronjob persistence across unmonitored accounts, the attackers ensure the botnet can regenerate, making complete eradication difficult. This method creates a significant forensic smokescreen, as activity appears to originate from legitimate, low-privilege users.
The payload is a heavily modified version of the open-source XMRig miner, specifically engineered for stealth. Upon execution, the malware unlinks its binary from the file system, running entirely from memory. This fileless execution leaves minimal traces for disk-based antivirus scans and forensic tools. Furthermore, the attackers disable core logging services and tamper with authentication logs, effectively blinding traditional monitoring methods that rely on log analysis.
The modified XMRig implant, based on version 6.25.0 and compiled with musl libc, includes a hardcoded banner identifying it as a "PRIVATE VERSION FOR BOTNET." To prevent multiple instances from competing for resources, it creates a mutex file at /tmp/.lock. The malware supports various mining algorithms, including RandomX, CryptoNight, and Argon2, allowing operators to optimize for profitability. Internal configurations are protected by layered XOR encryption, with keys like 'I3F0' and 'CLIENT' used to decode pool connection details.
Analysis of decoded credentials suggests the operation is part of a larger campaign tracked as 'V25 Generation 26,' potentially encompassing thousands of infected endpoints. The campaign's traffic to mining pools is disguised using a fake Java Agent user agent string, helping to blend Stratum traffic with legitimate web requests. This tactic mirrors other Linux malware that exploits misconfigurations by masking malicious connections.
To enhance evasion, this variant replaces the standard XMRig command interface with simplified custom flags tailored for scripted deployment. One notable flag allows the malware to spoof legitimate process names, such as 'ssh,' enabling it to blend into normal system activity and evade standard process monitoring tools. Another flag disables automatic cronjob installation, granting operators more granular control over persistence mechanisms.
Recommendations for defense focus on enhancing visibility and implementing zero-trust principles. Organizations should rigorously audit and restrict trusted third-party access, monitor for unauthorized modifications to logging services like rsyslog and auditd, and watch PAM and audit logs for unusual user switching patterns. Memory forensics is crucial for detecting self-deleting implants, and understanding how backdoors abuse PAM frameworks can help identify related warning signs.
Indicators of Compromise (IoCs) include the malicious domain unable[.]download used for mining pool infrastructure, and specific SHA-256, SHA-1, and MD5 hashes for the customized XMRig implant. The mutex file /tmp/.lock also serves as an indicator. The campaign's sophistication, combining supply chain compromise, memory-resident execution, and disguised traffic, points to an operation designed for sustained, long-term activity.