TLDR Tech / InfoSec
Linux XMRig Botnet Abuses PAM for Fileless Monero Mining and Persistent Access
A V25 (Generation 26) cryptomining campaign gained initial access through a trusted third-party relationship, then weaponized Linux PAM's pam_rootok policy to move password-lessly from root into ordinary user accounts, fragmenting malicious activity across shadowed identities in a "hydra-like" persistence model. The customized XMRig 6.25.0 build self-unlinked its own binary after execution, running fileless from memory while suppressing authentication logs and masquerading its process listings and network traffic. The operation reflects a broader trend in Linux cryptomining tradecraft, where supply chain compromise, identity-layer abuse, and anti-forensic design are converging to outpace file-based and DNS-centric detection models.
Read the full story