This threat involves a cryptomining malware campaign targeting Linux environments, leveraging trusted third-party access to gain initial entry and escalate to root privileges. The attackers abuse Linux Pluggable Authentication Modules (PAM) to impersonate multiple low-privileged users, thereby creating a forensic smokescreen and complicating detection. Persistence is maintained through cronjobs. The malware suppresses system logging and deploys a customized version of XMRig 6.25.0 that runs entirely in memory and self-unlinks after execution to avoid forensic artifacts. The binary uses XOR encryption to obfuscate its configuration and employs process masquerading techniques to blend with legitimate processes. The campaign is associated with the V25 Generation 26 malware family and communicates with the domain unable.download for mining pool operations.

The campaign enables unauthorized cryptomining on compromised Linux systems, leading to resource exhaustion and potential degradation of system performance. The use of PAM abuse and forensic evasion techniques complicates detection and incident response. Root-level access escalation increases the risk of full system compromise and persistent unauthorized control. The in-memory execution and self-unlinking behavior reduce forensic evidence, hindering post-incident analysis.

No official patch or remediation is indicated for this campaign. Since the threat leverages trusted third-party access and PAM abuse, organizations should review and restrict third-party access rights and monitor for unusual PAM activity. Detection efforts should focus on identifying anomalous user impersonation, cronjob persistence, suppressed logging, and process masquerading consistent with XMRig 6.25.0 behavior. Incident response should include verifying the integrity of PAM configurations and scheduled tasks. Patch status is not yet confirmed — check vendor advisories for updates.