Cryptomining Campaign Evades Detection by Avoiding Root Access on Linux Servers
A cryptomining operation has been identified that deliberately avoids root access on compromised Linux servers to bypass security alerts. The campaign, discovered by Group-IB in May 2026, uses a modified XMRig miner. Attackers gain initial access through third-party relationships and escalate privileges to root, then use Linux Pluggable Authentication Modules (PAM) to impersonate standard accounts without passwords. This creates a 'forensic smokescreen' by scattering activity across unmonitored accounts. The malware employs process masquerading and uses a Java/Agent user agent to blend in with normal web traffic. It deletes its binary from disk after execution, residing entirely in memory to avoid detection. Researchers recommend real-time log forwarding to external systems and hunting for transient artifacts like mutexes to detect such threats. 
