Case Study: Distribution of a CoinMiner Targeting Linux SSH Servers via Malware Distribution via Network Transmission

**Executive Summary:** ASEC observed an ongoing campaign targeting poorly managed Linux servers that uses SSH scanning and brute-force to deliver Go-based propagation malware, a custom XMRig CoinMiner (installed with persistence via systemd/cron and watchdog mechanisms), ShellBot (Perl DDoS bot), and command-obfuscation tools (Shc, XHide). The report includes malware behavioral details, installation and propagation commands, and multiple IoCs (URLs, IPs, FQDNs, MD5s) to aid detection and response.