A cryptomining crew has been quietly grinding Monero on other people's Linux servers using a set of tricks aimed squarely at the people who would investigate them. Group-IB analysts detailed the campaign, first identified in May 2026, in which the operators suppressed logging, deleted their own binary from disk, and spread persistence across low privilege accounts specifically so that cleaning up the obvious root compromise would not actually evict them.
How they got in
Initial access came through a trusted third party relationship, meaning the attackers pivoted from a partner environment the victim already allowed in rather than breaking down the front door. They escalated to root, and then did something unusual: instead of working as root, where any competent security team would notice, they abused the Linux Pluggable Authentication Modules stack.
Specifically they leaned on the pam_rootok policy, which lets root run the su command as any other user without being asked for a password. That let them scatter their activity across multiple ordinary accounts, planting duplicate cron jobs under each one. Group-IB describes the result as hydra-like: remediate the root compromise alone and the miner simply regrows from a user account nobody was monitoring.
To thin out the evidence further, the operators stopped core logging services and tampered with authentication logs, so the privilege escalation and the identity swapping left very little on disk to find.
A miner built to disappear
The payload is a heavily modified build of the open source XMRig 6.25.0 miner, cross compiled with musl libc and carrying an ASCII banner that reads "PRIVATE VERSION FOR BOTNET". On launch it creates a file based lock at /tmp/.lock so only one copy runs at a time, then deletes its own file from the filesystem while continuing to execute. From that point it exists only in memory, and a traditional file scan of the host comes back clean.
The build also swaps XMRig's normal command line parser for a stripped down one aimed at scripted mass deployment. A masquerade flag renames the process to look like ssh in tools such as ps and top, another flag connects to hardcoded pool addresses to sidestep DNS blocking, and another disables the automatic cron install. The miner tunes itself to each host by reading CPU model specific registers and allocating huge pages, and a companion shell script kills competing miners.
Group-IB pulled the campaign's own bookkeeping out of the binary. Layered obfuscation keys labelled I3F0 and CLIENT unwrapped the mining pool configuration, where the account name was hardcoded as My-V25-GEN-26, tying this infection to a tracked campaign generation the operators use to aggregate hash rate across thousands of hosts. Network traffic was disguised further with a Java/Agent user agent so the mining protocol blends into ordinary web traffic.
What defenders should do
Watch authentication logs for a root session rapidly switching into standard user accounts, the signature of the pam_rootok abuse here. Forward logs off the host in real time to a tamper resistant destination, and alert when logging services such as rsyslog or auditd are stopped, since silence is itself the indicator. Hunt for the /tmp/.lock mutex, audit cron jobs under every user rather than just root, and block the mining pool host unable[.]download at the resolver and the firewall.
Most importantly, treat a clean disk scan as meaningless against this class of threat. Because the binary unlinks itself, memory carving is what recovers the runtime configuration and the real process arguments. The same lesson applies to the log tampering we covered when researchers showed how attackers blind cloud audit trails, and to the self spreading XMRig worm hitting weakly secured Linux SSH servers earlier this month.
Indicators
Implant SHA-256 55c67c844258807c4335f40262777a5307bcf5b537c0492cf869b3328796f838, MD5 17b60d650fc5d1718d7f2ac3a6075d11. Mining pool host unable[.]download. Host artefacts: /tmp/.lock, cron entries under non root accounts, pool credentials My-V25-GEN-26 and V25-GEN-26.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.