Explaining the AI-Assisted Koske Linux Cryptomining Malware Hidden in JPEGs

## Executive summary This report describes the Koske 2025 Linux cryptomining campaign — an AI-assisted, modular threat that delivers and executes hidden payloads (e.g., polyglot JPEGs), establishes persistence via kernel modules, RC scripts, systemd and cron, evades detection using LD_PRELOAD hooks and firewall tampering, and stages encrypted XMrig miners; the document also details Picus simulation steps that safely emulate these TTPs to validate detection and defensive coverage.