{
  "Event": {
    "analysis": "1",
    "date": "2026-07-30",
    "extends_uuid": "",
    "info": "[Threat Intel] XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens",
    "protected": false,
    "publish_timestamp": "1785648732",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1785648731",
    "uuid": "eddede18-724b-40e1-83c5-0f5716a0705a",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:producer=\"Group-IB\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#95f9b9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Sudo and Sudo Caching - T1548.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#7da4ad",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Match Legitimate Resource Name or Location - T1036.005\"",
        "relationship_type": ""
      },
      {
        "colour": "#a4da83",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cron - T1053.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#4cf626",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clear Linux or Mac System Logs - T1070.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#fa3e60",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Clear Command History - T1070.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#75ec20",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Masquerading - T1036\"",
        "relationship_type": ""
      },
      {
        "colour": "#43c8db",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "relationship_type": ""
      },
      {
        "colour": "#71ecdb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "relationship_type": ""
      },
      {
        "colour": "#e43954",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Disable or Modify Tools - T1562.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#f07d7c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Standard Port - T1571\"",
        "relationship_type": ""
      },
      {
        "colour": "#6d779a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#356c41",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#57b2ae",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Resource Hijacking - T1496\"",
        "relationship_type": ""
      },
      {
        "colour": "#3c0f50",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Software Packing - T1027.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#92e858",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Bind Mounts - T1564.013\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"CryptoNight\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:malpedia=\"xmrig\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785495608",
        "to_ids": false,
        "type": "link",
        "uuid": "c3f50b7b-1221-4bf3-9fc3-9635494a8bd7",
        "value": "https://www.group-ib.com/blog/xmrig-covert-linux-pam-abuse/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785495609",
        "to_ids": false,
        "type": "text",
        "uuid": "a7ef16ed-7872-4d0a-8126-d83dc0a913da",
        "value": "In May 2026, a sophisticated Monero cryptomining campaign was identified targeting Linux environments. Attackers gained initial access through trusted third-party relationships, then escalated to root privileges. Rather than operating openly as root, they weaponized Linux Pluggable Authentication Modules (PAM) to impersonate multiple low-privileged users, creating a forensic smokescreen and establishing redundant persistence through cronjobs. The operators suppressed system logging and deployed a customized XMRig 6.25.0 implant that self-unlinks after execution, running entirely in memory. The binary uses XOR encryption for configuration obfuscation and employs process masquerading to blend with legitimate processes. Campaign tracking revealed operations linked to the V25 Generation 26 family, connecting to the domain unable.download for mining pool communication."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785495609",
        "to_ids": false,
        "type": "text",
        "uuid": "74293754-1f94-418f-80dd-e61ea9992cef",
        "value": "Name: XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens\nAuthor: AlienVault\nAdversary: \nTags: [\"pam abuse\", \"self-unlinking binary\", \"xmrig botnet\", \"linux\", \"cryptomining\", \"monero\", \"forensic evasion\", \"memory-resident\", \"trusted third-party compromise\", \"xmrig\"]\nTgtd countries: []\nMlwr families: [\"XMRig\"]\nAttack_ids: [\"T1548.003\", \"T1036.005\", \"T1053.003\", \"T1070.002\", \"T1070.003\", \"T1036\", \"T1055\", \"T1098\", \"T1562.001\", \"T1078\", \"T1571\", \"T1068\", \"T1027\", \"T1573\", \"T1195.002\", \"T1496\", \"T1027.002\", \"T1071.001\"]\nIndustries: []"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1785648690",
        "to_ids": true,
        "type": "domain",
        "uuid": "399bbee5-ca3d-4238-9810-5f0137ad136b",
        "value": "unable.download",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "first_seen": "2026-03-03T01:01:00+00:00",
        "last_seen": "2026-03-03T01:01:00+00:00",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1785648711",
        "uuid": "50659888-1841-4a6e-84fc-a2cbc6c15478",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T01:01:00+00:00",
            "last_seen": "2026-03-03T01:01:00+00:00",
            "object_relation": "md5",
            "timestamp": "1785648711",
            "to_ids": true,
            "type": "md5",
            "uuid": "a5646c3c-67e4-482c-aba8-c5b032afef67",
            "value": "17b60d650fc5d1718d7f2ac3a6075d11",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T01:01:00+00:00",
            "last_seen": "2026-03-03T01:01:00+00:00",
            "object_relation": "sha1",
            "timestamp": "1785643786",
            "to_ids": true,
            "type": "sha1",
            "uuid": "af56110b-f26c-4488-8a88-3c92ed32a838",
            "value": "88520bcfc741610591a23592f9d4ecb31e34deb5",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T01:01:00+00:00",
            "last_seen": "2026-03-03T01:01:00+00:00",
            "object_relation": "sha256",
            "timestamp": "1785643786",
            "to_ids": true,
            "type": "sha256",
            "uuid": "3ce83959-4496-4110-8911-48fb7b238eb6",
            "value": "55c67c844258807c4335f40262777a5307bcf5b537c0492cf869b3328796f838",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Other",
            "comment": "Checked: 02/08/2026\nLast-scan: 01/08/2026",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-03T01:01:00+00:00",
            "last_seen": "2026-03-03T01:01:00+00:00",
            "object_relation": "text",
            "timestamp": "1785643785",
            "to_ids": false,
            "type": "text",
            "uuid": "d2ace6fd-0669-49f6-8bed-9228cc80cb38",
            "value": "Type Description: ELF\nMicrosoft: Trojan:Linux/CoinMiner.C12\nClamAV: None\nVT Total Detection: 38/75\nFirst Submission: 2026-03-03T01:01:00+00:00\nLast Submission: 2026-03-03T01:01:00+00:00"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T01:01:00+00:00",
            "last_seen": "2026-03-03T01:01:00+00:00",
            "object_relation": "ssdeep",
            "timestamp": "1785643785",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "9789ef27-db3b-4b58-9851-a884462acf92",
            "value": "98304:Bjq/2EuZ2Y4saNwE9W9rWq0Q9NEi58TQq0bX+iiNJWix9/ju3M32SwYQS4Y:BRaLWnyHPLuRSwY54Y"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-03T01:01:00+00:00",
            "last_seen": "2026-03-03T01:01:00+00:00",
            "object_relation": "size-in-bytes",
            "timestamp": "1785643785",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "ff646e96-dd53-4398-ac0a-f7bf006f8be8",
            "value": "7709320"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "first_seen": "2026-03-03T01:01:00+00:00",
            "last_seen": "2026-03-03T01:01:00+00:00",
            "object_relation": "vhash",
            "timestamp": "1785643785",
            "to_ids": true,
            "type": "vhash",
            "uuid": "ae40c518-6856-4a70-82ac-0bfe48b33f12",
            "value": "bb550d77b39d2e1d468906115ac5cff4"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "first_seen": "2026-03-03T01:01:00+00:00",
            "last_seen": "2026-03-03T01:01:00+00:00",
            "object_relation": "filename",
            "timestamp": "1785643785",
            "to_ids": true,
            "type": "filename",
            "uuid": "470dc8bf-c74d-43bf-9a1a-71c925177c72",
            "value": "hlehahw98.exe"
          }
        ]
      }
    ]
  }
}