Full Report
Dive into a covert Linux XMRig campaign exploiting trusted access, weaponizing PAM to create forensic smokescreens, and deploying self-unlinking payloads.
Analysis Summary
# Tool/Technique: PAM-Weaponized Linux XMRig Campaign
## Overview
This campaign involves a sophisticated Linux-based cryptojacking operation that exploits trusted third-party access to deploy XMRig miners. The attack is notable for weaponizing the Pluggable Authentication Module (PAM) framework to maintain stealth and using "self-unlinking" payloads that delete themselves from the disk immediately after execution to minimize forensic footprints.
## Technical Details
- **Type**: Malware family (Cryptominer) / Post-Exploitation Technique
- **Platform**: Linux (Multiple distributions)
- **Capabilities**: Credential harvesting (via PAM), stealthy persistence, resource-optimized mining, log suppression, and automated cleanup.
- **First Seen**: Circa 2024 (based on recent campaign reporting)
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1543.002 - Create or Modify System Process: Systemd Service]
- [T1053.003 - Scheduled Task/Job: Cron]
- **[TA0004 - Privilege Escalation]**
- [T1556.003 - Modify Authentication Process: Pluggable Authentication Modules]
- **[TA0005 - Defense Evasion]**
- [T1070.002 - Indicator Removal: Clear Linux System Logs]
- [T1027.002 - Obfuscated Files or Information: Software Packing]
- [T1106 - Native API] (Self-unlinking/Execution in memory)
- [T1036.005 - Masquerading: Device Drivers]
- **[TA0040 - Impact]**
- [T1496 - Resource Hijacking]
## Functionality
### Core Capabilities
- **XMRig Deployment**: Deploys a customized version of the open-source XMRig miner to generate Monero (XMR).
- **PAM Weaponization**: Modifies Linux PAM to intercept credentials or bypass authentication, acting as a forensic "smokescreen" for malicious activity.
- **Self-Unlinking Payloads**: The binary deletes its own file on disk immediately after execution, continuing to run only in the system's memory.
- **Redundant Persistence**: Utilizes hidden cron jobs and masqueraded system services across multiple low-privilege accounts to ensure the miner restarts after reboots.
### Advanced Features
- **Execution Guardrails**: Checks for existing high-resource processes to prevent system instability or crashes that might alert administrators.
- **Hardware Optimization**: Automatically tunes the miner settings based on the infected host's CPU architecture to maximize the hash rate.
- **XOR Obfuscation**: Uses XOR-based encoding for its configuration files to evade static analysis and basic string detection.
- **Log Suppression**: Actively modifies or suppresses system logs to hide connection attempts and execution artifacts.
## Indicators of Compromise
- **File Hashes**:
- **SHA-256**: `55c67c844258807c4335f40262777a5307bcf5b537c0492cf869b3328796f838`
- **SHA-1**: `88520bcfc741610591a23592f9d4ecb31e34deb5`
- **MD5**: `17b60d650fc5d1718d7f2ac3a6075d11`
- **File Names**: Often masquerades as legitimate system processes (e.g., `kworker`, `udevd`).
- **Network Indicators**:
- `unable[.]download` (Mining Pool/C2)
- **Behavioral Indicators**:
- Presence of a mutex file at `/tmp/.lock`.
- Unexpected modifications to files in `/etc/pam.d/`.
- High CPU utilization from processes with spoofed names.
- Cron jobs hidden in `/var/spool/cron/crontabs/` for non-standard users.
## Associated Threat Actors
- Unknown (Current campaign attributes activity to a sophisticated, financially motivated group focusing on Linux cloud infrastructure).
## Detection Methods
- **Signature-based detection**: Scanning for the SHA-256 hashes provided, though self-unlinking makes this difficult post-execution.
- **Behavioral detection**: Monitoring for unauthorized modifications to PAM configuration files and monitoring process memory for strings associated with XMRig.
- **Auditd Logging**: Use Linux Auditd to track `unlink` system calls following a process execution and to monitor modifications to `/etc/pam.d/`.
## Mitigation Strategies
- **PAM Integrity**: Use file integrity monitoring (FIM) to alert on any changes to the `/etc/pam.d/` directory and `/lib/security/` modules.
- **Least Privilege**: Restrict third-party access and ensure service accounts have the minimum permissions necessary, preventing the installation of new cron jobs.
- **Resource Monitoring**: Implement alerts for sustained high CPU usage across the environment.
- **Network Filtering**: Block known mining pools and use DNS filtering to prevent resolution of the `unable[.]download` domain.
## Related Tools/Techniques
- **XMRig**: The legitimate open-source miner commonly repurposed by threat actors.
- **Reflective Code Loading**: Similar to the self-unlinking technique used here to avoid disk-based detection.
- **Rootkits**: While not a full rootkit, the PAM weaponization mimics rootkit-like behavior for credential persistence.