Cyble Research & Intelligence Labs (CRIL) has uncovered a sophisticated Linux-targeting campaign that combines a Mirai-derived botnet with a stealthy, fileless cryptominer.
This hybrid threat is designed to maximize both disruption and financial gain, leveraging advanced evasion techniques to target cloud environments, servers, and exposed IoT devices.
Multi-Stage Infection and Stealth Tactics
The attack begins with a shell script dubbed the “Universal Bot Downloader,” which automatically detects the system architecture (x86_64, ARM, MIPS) and downloads the corresponding bot binary from a malicious server.
The payload is written to /tmp, given executable permissions, and launched immediately. The downloaded binary, named Mddos.x86_64, is a UPX-packed, statically linked ELF file with stripped symbols, making static analysis difficult.
Once active, the malware masquerades as the legitimate system daemon systemd-logind using process name spoofing and detaches from the terminal to run silently.
It gathers system information such as the kernel version, architecture, and process limits before initializing random seeds to introduce timing variability.
The malware then spawns multiple worker threads to handle attack operations, command-and-control (C2) communication, and internal coordination via a localhost TCP listener on port 63841.
A key feature of this botnet is its use of raw TCP sockets to conduct high-speed SSH scanning across the internet. The malware floods port 22 with SYN packets, searching for vulnerable hosts to compromise.
Simultaneously, it resolves its C2 domain (www.baojunwakuang[.]asia) through repeated DNS queries to Google Public DNS (8.8.8.8), ensuring resilient connectivity.
Fileless Cryptominer and Dynamic Configuration
The final stage of the attack involves deploying a cryptominer based on XMRig. The bot downloads a UPX-packed XMRig binary and disguises it as .dbus-daemon in /tmp.
Instead of using a static configuration file, the miner dynamically fetches its settings, such as wallet address, mining pool, and algorithm, from the C2 server at runtime. This fileless approach leaves no on-disk artifacts, making forensic analysis and detection significantly harder.
The campaign’s blend of Mirai-style DDoS capabilities and fileless cryptomining reflects a growing trend in hybrid monetization strategies.
Attackers are increasingly leveraging infected devices for both botnet attacks and illicit cryptocurrency mining, maximizing their return on investment.
Organizations running Linux servers, cloud workloads, or exposed IoT devices should prioritize hardening their external attack surface, monitoring for anomalous network activity, and deploying runtime monitoring solutions.
Regular patching and proactive threat hunting are essential to mitigate the risk posed by this evolving threat.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
 has uncovered a sophisticated Linux-targeting campaign that combines.){kind=link}