XMRig Linux Botnet Exploits PAM, Trusted Access to Deploy Fileless Crypto Miner

A newly documented Monero cryptomining campaign is forcing incident responders to rethink what “low severity” means. Discovered in May 2026, this Linux-targeting operation blends supply-chain exploitation with a level of anti-forensic engineering rarely seen in coin-mining malware, proving that even “just a miner” can carry the operational security discipline of a nation-state implant.

The intrusion didn’t start with an exploit. It started with trust. The threat actor leveraged a legitimate third-party network relationship to gain access to the target environment, entering as a standard user before escalating to root.

That pivot from a trusted vendor connection into the primary network is the campaign’s first red flag for defenders: perimeter-based trust models remain a soft underbelly, regardless of how hardened the internal environment appears.

XMRig Linux Botnet Exploits PAM

Rather than operating openly as root, which reliably trips SOC alerts, the actor abused the pam_rootok policy to hop into multiple low-privileged accounts via su, without needing a single password. This wasn’t lateral movement for access; it was lateral movement for camouflage.

By seeding cronjob persistence across scattered, unmonitored standard accounts, the operators built redundancy resembling a hydra: sever the root compromise, and the botnet simply regrows from a dormant shadow account.

Compounding this, the actor disabled logging services and scrubbed authentication logs, blinding file-based monitoring at the exact moment PAM manipulation occurred.

“Cryptominers used to be the noise you’d tune out. This campaign shows operators borrowing APT-grade tradecraft PAM abuse, log suppression, memory-only execution to buy themselves the one thing every threat actor wants: time. Treating coin-mining as a nuisance alert is no longer defensible.”

The payload is a customized XMRig 6.25.0 build, cross-compiled with musl libc and stamped with a defiant banner: “PRIVATE VERSION FOR BOTNET.”

On execution, it creates a /tmp/.lock mutex to prevent overlapping instances, then immediately unlinks its own binary from disk while continuing to run in memory. Antivirus sweeps of the filesystem come back clean because there’s nothing left to find on disk.

Once resident in RAM, it profiles CPU topology, spawns optimized worker threads, taps kernel MSRs, allocates huge pages, and uses a companion script to kill competing processes, squeezing maximum hashrate from stolen compute.

The implant discards standard XMRig arguments for a streamlined, deployment-friendly set:

-lan: hardcoded pool IPs to bypass DNS sinkholes
-h: masquerades process names (e.g., disguising as “ssh”)
-c: disables auto-cron installation
-k: forces max hashrate, sacrificing stability
-dp: shorthand for static IP plus custom port

It supports the RandomX, CryptoNight, and Argon2 algorithm families, allowing operators to pivot mining targets based on victim hardware or market conditions.

Layered XOR keys “I3F0” and “CLIENT” conceal configuration strings and pool credentials. Decryption revealed the mining user as My-V25-GEN-26 and password V25-GEN-26, tagging this operation as part of a “V25 (Generation 26)” campaign family used to aggregate hashrate across compromised fleets.

The malware also employs MITRE technique T1564.013 (Hide Artifacts), masquerading as “ssh” in process listings and disguising Stratum mining traffic with a “Java/Agent” User-Agent header to blend into ordinary web traffic.

Enforce Zero Trust controls on third-party and vendor network access
Alert on rapid root-to-standard-user PAM transitions (USER_START events tied to pam_rootok)
Forward logs to tamper-proof external SIEMs in real time
Hunt for transient artifacts like /tmp/.lock and conduct memory forensics for hidden processes
Block the known C2 domain unable.download and associated infrastructure at the DNS and firewall layer

This campaign is a reminder that cryptomining malware has quietly matured into a proving ground for evasion techniques that later show up in far more destructive payloads.