Threats Tagged 'cryptocurrency-mining'

During Q3 2026, attacks targeting poorly managed Linux SSH servers were observed, primarily using brute force and dictionary attacks. The main malware families involved were ShellBot, a Perl-based DDoS bot, and Fisieredoor, a backdoor capable of command execution and deploying SSH dictionary attack tools. Attackers used wget or curl to download malware, then installed user-mode rootkits, process masking tools (XHide), and XMRig cryptocurrency miners. The malware launcher used ld.so.preload to inject rootkits and disguised mining processes as legitimate bash sessions. Fisieredoor also deployed tools for credential harvesting and lateral movement, transmitting successful authentication data to command servers.