Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access

A covert Monero (XMR) cryptomining campaign uncovered in May 2026 is abusing Linux Pluggable Authentication Modules (PAM) to evade detection, maintain fileless execution, and persist across multiple user accounts on compromised hosts.

The operation, tracked as part of the V25 (Generation 26) campaign family, demonstrates a mature blend of supply chain abuse, PAM weaponization, and MITRE ATT&CK T1564.013 “Hide Artifacts” tradecraft.

After achieving initial foothold, the attacker escalates privileges to root and immediately transitions into a stealth posture.

Instead of operating overtly as root an activity likely to trigger SOC alerts the actor weaponizes PAM by abusing the pam_rootok policy in combination with the su utility.

This enables password‑less switching from root into multiple low‑privileged accounts, creating a forensic smokescreen in which malicious activity is fragmented across ordinary users and redundant cron‑based persistence is quietly planted under unmonitored identities.

If responders focus only on remediating the root compromise, the botnet re‑emerges from these shadowed accounts, embodying a “hydra‑like” persistence model.

To further degrade visibility, the operators actively interfere with host telemetry. Key logging services are stopped and authentication logs are pruned or removed, blinding defenses that rely on file‑based monitoring and hindering reconstruction of the initial privilege escalation chain.

This aligns closely with ATT&CK’s Hide Artifacts family (T1564), and specifically the Linux‑focused sub‑technique T1564.013, which documents abuse of native OS features to conceal process and filesystem artifacts from standard tooling.

In this campaign, hiding is achieved not only at the filesystem level, but also at the process and network layers, ensuring that routine administrative views (ps, top, /proc) and perimeter telemetry reveal little about the ongoing cryptomining activity.

At the core of the operation is a heavily customized build of XMRig 6.25.0, cross‑compiled with musl libc and internally branded as “PRIVATE VERSION FOR BOTNET.”

The binary implements execution guardrails by creating a mutex at /tmp/.lock to enforce single‑instance operation and prevent resource contention that might expose the compromise to administrators.

Immediately after creating this lock, the implant self‑unlinks deleting its own executable from disk while continuing to run in memory.

This fileless execution paradigm dramatically complicates digital forensics, as there is no static binary left for traditional endpoint scanners to flag, and investigative efforts must pivot to RAM acquisition and memory carving to recover runtime artifacts and configuration data.

Once resident in memory, the miner aggressively optimizes hardware utilization. It profiles CPU topology, allocates Huge Pages, and interacts with Model‑Specific Registers (MSRs) to maximize hashrate while a companion bash script terminates competing processes to monopolize system resources.

Its bespoke command‑line interface diverges from standard XMRig usage, introducing flags such as “‑lan” for LAN pool mining via hardcoded IPs that bypass DNS sinkholes, “‑h” for process masquerading (for example, spoofing “ssh” in process listings), “‑c” to disable auto‑installed.

GroupIB Researchers said that, the intrusion begins with exploitation of a trusted third‑party relationship, allowing the threat actor to pivot from a partner environment into the victim’s network using a legitimate user account, effectively bypassing perimeter controls.

Linux XMRig Botnet

The implant supports multiple mining algorithm families, including RandomX, CryptoNight variants, and Argon2 profiles, giving operators flexibility to pivot between cryptocurrencies and hardware profiles without redeploying new payloads.

Binary analysis by Group‑IB researchers revealed layered XOR‑based obfuscation used to conceal configuration strings and operational telemetry. The key chain “I3F0” → “xmrig” decodes argument strings, while a secondary “CLIENT” key decrypts mining pool identifiers and default settings.

Decrypted defaults expose the pool host as “unable.download” and embed campaign tracking markers via hardcoded credentials: a User value of “My‑V25‑GEN‑26” and Password “V25‑GEN‑26.”

These identifiers allow the botmaster to aggregate performance metrics per generation across thousands of infected endpoints and tie activity back to the broader V25 botnet lineage.

At the network layer, the miner disguises its JSON‑RPC Stratum traffic behind a benign‑looking “Java/Agent” user agent string, blending into typical web application traffic and frustrating basic signature‑based detection.

The campaign’s use of MITRE ATT&CK technique T1564.013 to hide artifacts combined with supply chain‑driven initial access, PAM‑mediated identity smokescreens, aggressive log suppression, and fileless self‑unlinking illustrates the current sophistication of Linux‑focused cryptomining botnets.

For defenders, static file scanning and simple DNS‑based blocking are no longer sufficient. Detection strategies must incorporate continuous integrity monitoring of PAM and logging infrastructure.

High‑fidelity auditing of rapid root‑to‑user transitions, proactive hunting for transient mutex artifacts such as /tmp/.lock, and routine memory forensics to recover in‑memory configurations, process arguments, and JSON‑RPC payloads.

Security teams, particularly cybersecurity analysts, threat intelligence professionals, incident responders, and SOC operators, should treat this campaign as a blueprint for future Linux cryptominer activity.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

$1M Data Breach Warranty is Genuine Protection?: Download 10 Point Free AI SOC Breach Warranty Guide