Cryptomining campaign targeting Linux SSH servers (Campaign)
ID: b170ea66-2685-511a-a521-b917f9a9d921
STIX ID: report--b170ea66-2685-511a-a521-b917f9a9d921
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2026-07-12
Date Updated: 2026-07-19
Author: [email protected] (Wiz Threat Research)
...
...
AhnLab ASEC identified an ongoing cryptomining campaign (active since at least 2023) that brute-forces internet-exposed Linux SSH servers with weak credentials, installs a multi-stage toolkit (Go downloaders, propagation malware, customized XMRig miners, ShellBot, XHide), establishes persistence via systemd/cron, hides activity and cleans logs, and scans for additional vulnerable SSH hosts to propagate.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.