AI-Generated Malware in Panda Image Hides Persistent Linux Threat

Aqua Nautilus describes "Koske", a sophisticated Linux cryptomining malware campaign that abuses misconfigured JupyterLab for initial access, delivers payloads via polyglot JPEG files, compiles and loads a userland rootkit via LD_PRELOAD, manipulates system startup, DNS and firewall settings for persistence and C2 connectivity, and dynamically selects and runs multiple miners; the report includes IOCs and recommends runtime, network, and AI-detection controls.