A cryptomining operation has been observed abandoning root access on compromised Linux servers in favor of impersonating low-privileged users, a deliberate downgrade designed to avoid the alerts that root activity triggers in a security operations center (SOC).
According to new research from Group-IB published on July 30, the Monero mining campaign was identified in May 2026 after operators reached a victim network through a trusted third-party relationship.
They escalated to root, then abused the pam_rootok policy in Linux Pluggable Authentication Modules (PAM) to assume the identities of multiple standard accounts without needing their passwords.
Read more on cryptojacking crews: Cryptojacking Gang TeamTNT Make a Comeback
Hiding From Analysts and Logs
Group-IB called the result “a forensic smokescreen”. By scattering activity and redundant cron job persistence across accounts nobody was monitoring, the operators ensured that a responder who cleaned up the root compromise would find the implant regenerating from the shadowed accounts.
They also stopped core logging services and tampered with authentication logs, leaving minimal on-disk trace of either the privilege escalation or the PAM manipulation that followed it.
Concealment extended to the process and network layers. A custom flag enabled process masquerading, spoofing legitimate names such as ssh in process listings, which Group-IB mapped to MITRE technique T1564.013.
Mining traffic carried a Java/Agent user agent to blend its Stratum packets into ordinary web application flows.
A Miner That Deletes Itself
The implant is a modified build of XMRig 6.25.0, cross-compiled with musl libc and carrying a hardcoded banner identifying it as a private botnet version. On startup it creates a file-based mutex at /tmp/.lock so only one instance runs, avoiding the resource contention that would destabilize the host and alert administrators.
It then deletes its own binary from disk while continuing to run, moving entirely into memory, which Group-IB noted leaves conventional disk scans clean.
Once resident, the malware reads the host’s CPU topology and spawns worker threads accordingly, interacting with kernel model-specific registers (MSR) and allocating Huge Pages to maximize hash rate. A companion bash script terminates competing miners.
Layered XOR keys concealed the configuration. Decrypting them exposed a hardcoded campaign identifier that Group-IB linked to a wider family used to aggregate hash rates across compromised hosts.
The firm urged organizations to forward logs in real time to a tamper-proof external system, restrict cross-environment connections from vendors and clients and hunt for transient artifacts such as the /tmp/.lock mutex, since the self-unlinking behavior makes memory forensics essential.
