In the third quarter of 2026, multiple attack campaigns targeted poorly managed Linux SSH servers using brute force, dictionary attacks, and vulnerability exploits. Attackers deployed ShellBot, a Perl-based DDoS bot with port scanning and UDP flooding capabilities. A complex attack chain involved a user-mode rootkit loaded via /etc/ld.so.preload, which then deployed the XMRig cryptocurrency miner disguised as a bash process using the XHide concealment tool. Additionally, the Fisieredoor backdoor was used to execute commands and install SSH brute-force tools such as goauto and tsm-family that systematically targeted systems with credential lists. Organizations are advised to implement strong password policies, maintain regular patching schedules, and enforce access controls on externally exposed SSH infrastructure.
AhsayCBS backup utility versions up to 10.3.4 contain a vulnerability (CVE-2026-105133) that allows unauthenticated remote code execution. Exploitation involves chaining two critical vulnerabilities to bypass authentication and execute code with SYSTEM privileges. Attackers have deployed webshells, cryptocurrency miners disguised as legitimate processes, and persistence mechanisms including fake Windows services and kernel driver exploitation. Managed service providers are primarily targeted.
A cryptomining botnet compromised 3,562 Redis servers by exploiting unauthenticated Redis instances using rogue replication to inject cron jobs that deployed XMRig miners. The affected Redis versions range from 2.8.17 to 7.2.0 across various Linux distributions, indicating misconfiguration rather than a software vulnerability. The attacker toolkit, exposed via an open directory, contained exploit source code, campaign logs, and Windows registry hives. Additional attack vectors targeting WordPress, MongoDB, and SSH were included but did not result in confirmed compromises. The operation mined Monero using a wallet linked to the operator's own systems. Meterpreter deployment capabilities were also observed, extending the operator's activity timeline. No known exploits in the wild or vendor patches are documented.
This article provides a detailed technical analysis of the critical macOS Screen Sharing vulnerability CVE-2026-65400, which allows unauthenticated remote root access via a logic flaw in the screensharingd daemon. It explains active exploitation by threat actors deploying Monero miners, the mechanics of the authentication bypass, and urgent mitigation steps including patching and network hardening.
In May 2026, a sophisticated Monero cryptomining campaign was identified targeting Linux environments. Attackers gained initial access through trusted third-party relationships, then escalated to root privileges. Rather than operating openly as root, they weaponized Linux Pluggable Authentication Modules (PAM) to impersonate multiple low-privileged users, creating a forensic smokescreen and establishing redundant persistence through cronjobs. The operators suppressed system logging and deployed a customized XMRig 6.25.0 implant that self-unlinks after execution, running entirely in memory. The binary uses XOR encryption for configuration obfuscation and employs process masquerading to blend with legitimate processes. Campaign tracking revealed operations linked to the V25 Generation 26 family, connecting to the domain unable.download for mining pool communication.
A sophisticated npm supply chain attack was uncovered involving the typosquatted package crypto-javascri, designed to mimic the legitimate crypto-js library. The malware harvests npm and GitHub credentials from infected systems, hijacks maintainer accounts, and automatically republishes trojanized versions of packages under trusted identities. The final payload incorporates a weaponized Arti Tor client with credential theft, cryptomining capabilities, privilege escalation via SUID exploitation, and systemd-based persistence mechanisms. The campaign specifically targets Linux developer systems and CI/CD environments, using Tor-based command-and-control infrastructure to maintain anonymity and resilience. The attack creates significant downstream supply chain risk through its worm-like propagation model.
An exposed open directory on a command and control server revealed a complete deployment of the BYOB (Build Your Own Botnet) framework. The multi-stage infection chain targets Windows, Linux, and macOS platforms, implementing seven persistence mechanisms. The malware includes extensive post-exploitation capabilities such as keylogging, packet capture, and email harvesting. Analysis uncovered a modular design with encrypted C2 communications and infrastructure reuse across multiple regions. Two nodes also hosted XMRig cryptocurrency miners, indicating additional monetization efforts. The campaign has been operational for approximately 10 months, demonstrating geographic and provider diversification in its infrastructure.
Tangerine Turkey is a cryptomining campaign that propagates via VBScript worms spread through USB drives, leveraging legitimate system binaries for execution and persistence. The malware employs advanced defense evasion techniques such as registry modification and masquerading malicious files as legitimate system components. It establishes persistence through malicious services and scheduled tasks while attempting to disable Windows Defender. Although its primary objective is unauthorized cryptocurrency mining, its capabilities for persistence and lateral movement pose broader security risks. The campaign uses living-off-the-land binaries and creates mock directories to conceal its activities. No known CVEs or exploits are currently associated with this threat. The medium severity rating reflects the financial motivation and potential for system compromise without immediate destructive impact. European organizations using Windows systems with USB access are at risk, especially those with lax endpoint security controls and high-value targets. Mitigation requires targeted controls beyond generic advice, including USB device management, monitoring for living-off-the-land abuse, and registry integrity checks.
A phishing campaign targeting Ukrainian government entities uses malicious SVG files to initiate an infection chain. The attack begins with emails containing SVG attachments that redirect victims to a download site. A CHM file is then used to execute a remote HTA loader, which delivers two malware payloads: Amatera Stealer and PureMiner. Amatera Stealer harvests extensive information from infected systems, including credentials, system data, application data, browser files, and cryptocurrency wallets. PureMiner collects hardware information and monitors system activity to deploy efficient CPU or GPU mining modules. The campaign demonstrates sophisticated techniques, including fileless malware delivery and the use of multiple stages to evade detection.
A routine monitoring by researchers uncovered an exploitation attempt on a honeypot server running TeamCity, a CI/CD tool. The attack exploited an exposed Java Debug Wire Protocol (JDWP) interface, leading to remote code execution, deployment of cryptomining payload, and establishment of multiple persistence mechanisms. The attack was notable for its rapid exploitation, use of a customized XMRig payload, and stealthy crypto-mining techniques. JDWP, designed for debugging Java applications, becomes a high-risk entry point when exposed to the Internet without proper authentication. The attackers used a structured sequence to achieve remote code execution, likely using a variant of jdwp-shellifier. They deployed a dropper script that installed an XMRig miner and set up various persistence mechanisms including boot scripts, systemd services, cron jobs, and shell configuration files.
A sophisticated Linux malware campaign called Koske has been discovered, showing signs of AI-assisted development. The threat exploits misconfigured servers to install backdoors and download weaponized JPEG images containing malicious payloads. The malware uses polyglot file abuse to hide shellcode within images, deploys a userland rootkit, and employs various persistence techniques. It aggressively manipulates network settings to ensure command-and-control communication. The malware supports 18 different cryptocurrencies and adapts its mining strategy based on the host's capabilities. The code structure and adaptability suggest AI involvement in its creation, marking a concerning shift in malware development and posing significant challenges for cybersecurity defenses.
A resurgence of malware deploying XMRig cryptominer was discovered in mid-April 2025, coinciding with a rally in Monero cryptocurrency value. The malware uses a multi-staged approach and LOLBAS techniques, leveraging Windows tools like PowerShell for payload delivery, detection evasion, and persistence. The attack chain involves three stages: initial infection via a batch file, persistence establishment, and cryptomining execution. The malware targets diverse countries, including Russia, Belgium, Greece, and China. It disables Windows Update services, evades Windows Defender, and uses scheduled tasks for persistence. The XMRig miner creates registry entries and drops files for continued operation. Despite its simple, unobfuscated nature, the malware proved effective in avoiding detection.
The Mimo intrusion set is exploiting CVE-2024-46483, a Remote Code Execution vulnerability in Craft CMS, to deploy webshells and execute malicious payloads. The attack chain includes downloading infection scripts and deploying a loader, cryptominer (XMRig), and residential proxyware (IPRoyal) for financial gain. The group uses unique identifiers such as '4l4md4r' and 'n1tr0' and has been linked to operators 'EtxArny' and 'N1tr0'. Detection can focus on unusual processes in temporary directories and kernel module changes. The campaign targets Craft CMS installations globally, with a focus on financially motivated exploitation rather than geopolitical objectives. The threat is medium severity due to the impact on confidentiality and availability, ease of exploitation via RCE, and the scope of affected web servers. Organizations using Craft CMS should prioritize patching and monitoring for indicators of compromise.
