Gafgyt Botnet: Weak SSH Passwords Targeted For GPU Mining

A newly observed Gafgyt botnet variant is actively brute-forcing weak SSH credentials to compromise devices and cloud-native servers, deploying a GPU-enabled XMRig Monero miner that leverages –opencl and –cuda to use GPU/NVIDIA resources. The variant includes a worming/scanning module (ID-musl-x86), terminates competing malware, uses Tor to hide activity, and is linked to the Keksec actor; researchers warn this represents an evolution toward targeting high-CPU/GPU cloud environments.