Linux Cryptomining Campaign Leverages PAM to Conceal XMRig Botnet

Key Takeaways

• A sophisticated Linux cryptomining campaign is actively exploiting the Pluggable Authentication Modules (PAM) framework to maintain persistence and evade detection.
• Threat actors leverage PAM to seamlessly switch between privileged and unprivileged accounts without authentication, creating a “forensic smokescreen.”
• The campaign utilizes a heavily modified, fileless XMRig miner that deletes its binary from disk, operating solely from memory to bypass traditional antivirus and file-based monitoring.
• Attackers disable logging services and modify authentication records, making detection and forensic analysis exceptionally challenging.
• The campaign, tracked as “V25 Generation 26,” employs advanced evasion tactics typically seen in state-sponsored or advanced persistent threat (APT) operations.

A novel Linux cryptomining operation has emerged, employing an advanced and rarely observed technique to maintain stealth within compromised networks. Instead of relying on conventional malware behaviors that often trigger security alerts, the operators have repurposed a fundamental Linux security feature to mask their activities. This allows them to covertly mine Monero cryptocurrency, effectively bypassing standard detection mechanisms.

The campaign, first identified in May 2026, began with threat actors breaching a target network through an established third-party connection. Once inside, they swiftly escalated privileges to gain root access, the highest level of control on a Linux system. However, rather than operating overtly as root—a move that typically raises immediate flags in security operations centers—the attackers opted for a more insidious approach.

Their strategy involved weaponizing the Pluggable Authentication Modules (PAM) framework, enabling them to transition between accounts with low privileges without requiring passwords. This technique distributes malicious activity across multiple, less scrutinized accounts, effectively creating what researchers describe as a “forensic smokescreen.” Analysts at Group-IB said in a report that this method ensures the botnet can regenerate even if the initial root compromise is detected and remediated.

The payload itself is a significantly customized version of the open-source XMRig miner. It has been engineered to erase its own footprint immediately upon execution. Group-IB detailed that the malware deletes its binary from disk, continuing to operate entirely from memory. This “fileless” approach leaves minimal traces for traditional antivirus solutions to detect. Coupled with disabled logging and manipulated authentication records, the malware effectively blinds file-based monitoring systems.

This cryptomining campaign underscores a growing trend where operators of illicit mining operations are adopting sophisticated tradecraft previously associated with advanced threat actors. The use of supply chain trust, memory-resident execution, and disguised network traffic indicates an operation designed for long-term persistence and evasion. Examining trends in recent ransomware attack analysis can provide valuable context for early detection of similar advanced techniques.

Linux Cryptomining Campaign Weaponizes PAM

The primary stealth mechanism of this campaign lies in its abuse of the pam_rootok policy within the PAM authentication stack. After establishing root access, the attackers exploited the standard su command to impersonate lower-privileged users without needing their passwords. This allowed them to deploy persistent malicious cronjobs across numerous unmonitored accounts. Consequently, merely addressing the initial root compromise would not be sufficient to eliminate the botnet, as it would simply reactivate from another compromised account. For further technical details, see the Group-IB report.

To further impede detection, the operators halted critical logging services and modified authentication logs on compromised systems. This systematic log tampering left minimal forensic evidence on disk, effectively blinding security tools that rely on static log analysis rather than dynamic memory inspection. Security teams investigating similar incidents should review recent Linux privilege escalation flaws, as many attacks leverage weaknesses in authentication components to achieve their objectives. Additional details on evasion tactics are available in the Group-IB report.

The implant, based on XMRig version 6.25.0 and cross-compiled with musl libc, includes a distinct hardcoded banner: “PRIVATE VERSION FOR BOTNET.” To prevent resource contention, it creates a mutex file at /tmp/.lock, ensuring only one instance runs at a time. This behavior is documented in the <a href="https://ppl-ai-file-upload.s3.amazonaws.com/web/direct-files/attachments/11146061/63321a41-fbeb-4200-9beb-0a68f46efdc3/Linux-Cryptomining-Campaign-Weaponizes-PAM-to-Hide-XMRig-Botnet-Activity.pdf?AWSAccessKeyId=ASIA2F3EMEYERMWG3CI5&Signature=IjLMUszhj%2Bnv8Qme7JVnJO5k4%2Fk%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEMn%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJGMEQCIA0M%2BQ5HdAoA0g7bbYAjxjKYCLm2j%2Bh4m6mweNTMa%2B2%2FsrAiAe%2FORosk%2FFlUIRm0WWMGBCco1dt4dtTRfBE79yYzWa%2BSr8BAiS%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F8BEAEaDDY5OTc1MzMwOTcwNSIMd0m9wtt8b%2Ba1OTbmKtAEBOHmyeQG%2BYXKPYxn506mxfRRT67dG0KzWbYN3R3Wi

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.