‘Yet another Mirai-based botnet’ is spreading an illicit cryptominer

NoaBot is a Mirai-derived botnet campaign observed for about a year that spreads via Linux SSH and installs a modified XMRig cryptominer. Akamai researchers highlight substantial code obfuscation and customizations indicating operational security and capability, possible ties to the P2PInfect worm, and actor behaviors that complicate attribution despite juvenile in-jokes embedded in binaries.