Linuxsys Cryptominer Campaign (Campaign)

The Linuxsys cryptominer campaign, active since at least 2021, leverages multiple n-day web application vulnerabilities (including CVE-2021-41773 and others from 2023–2024) to deliver a persistent Linux coinminer. Attackers deploy an initial bash installer that pulls the miner and configs from compromised legitimate sites, establish persistence via cron jobs, and operate XMRig mining against hashvault.pro; the operation yields modest daily returns but demonstrates sustained, disciplined infrastructure management.