CoinMiner (KONO DIO DA) Distributed to Linux SSH Servers

AhnLab Security Emergency response Center (ASEC) has recently discovered XMRig CoinMiner being installed on poorly managed Linux SSH servers. The attacks have been happening with a distinct pattern since 2022: they involve the usage of malware developed with Shell Script Compiler (SHC) when installing the XMRig, as well as the creation of a backdoor SSH account.

When looking at the attack cases against poorly managed Linux SSH servers, most of them involve the installation of DDoS Bot or CoinMiner. DDoS …

ahnlab asec attacks center coinminer compiler distributed emergency linux malware malware analysis managed response script security servers shc shell shell script ssh xmrig