This discovery was made by Group-IB in May 2026 during a Monero mining campaign that infiltrated a network through a trusted third-party relationship. The attackers escalated their privileges to root level, leveraging the pam_rootok policy in Linux Pluggable Authentication Modules (PAM) to assume the identities of standard accounts without requiring their passwords.

By impersonating low-privileged users, the cryptomining operators created a “forensic smokescreen” to hide their activities. They spread their actions across multiple accounts that were not actively monitored, making it difficult for responders to detect and remove the malicious implant. Additionally, they disabled core logging services and manipulated authentication logs to minimize traces of their actions.

To further conceal their activities, the operators implemented process masquerading and used a Java/Agent user agent for mining traffic to blend in with legitimate web application traffic. The malware employed was a modified version of XMRig 6.25.0, compiled with musl libc and designed to delete its own binary from disk upon startup, running entirely in memory to avoid detection by conventional disk scans.

The malware utilized XOR keys to encrypt its configuration, with Group-IB identifying a hardcoded campaign identifier linked to a broader family of campaigns aimed at aggregating hash rates from compromised hosts. In response to these findings, Group-IB recommended organizations to send logs to an external tamper-proof system in real-time, restrict connections from vendors and clients, and conduct memory forensics due to the self-deleting behavior of the malware.

This shift in tactics by cryptomining operators demonstrates a continued evolution in cyber threats and the need for organizations to remain vigilant in detecting and responding to such attacks. By staying informed and implementing best practices in cybersecurity, businesses can better protect themselves against these increasingly sophisticated threats.

Ethereum Analyst Predicts Major Surge as ETH Holds Support at $2,375

A well-known crypto analyst on X is drawing attention to Ethereum’s (ETH) current position within a four-hour channel, hinting at a potential significant surge for the cryptocurrency.

Ali, a pseudonymous crypto strategist with a large following of 166,400 followers, is optimistic about Ethereum’s future after it successfully held support around the $2,375 mark.

According to Ali, he believes that Ethereum could see a substantial increase in value, potentially reaching $3,000 if it manages to break through the resistance at $2,570.

“ETHEREUM: ALL EYES ON $2,570

Despite recent market volatility, Ethereum is still trading within its four-hour channel.

Now that the price has reached the lower boundary of the channel, I am anticipating a rebound towards the mid-range and eventually targeting the upper boundary around $2,570.

This level is crucial.

A strong four-hour close above $2,570, supported by significant trading volume, could signal a breakout and pave the way for Ethereum to reach $2,700 and potentially even $3,000.”

Ali also noted earlier this week that a significant amount of Ethereum has been withdrawn from crypto exchanges, totaling around $350 million worth of ETH. This movement suggests that investors are increasingly opting to hold onto their Ethereum holdings for the long term.

“$350 MILLION IN ETHEREUM LEAVES EXCHANGES

Over the past 96 hours, approximately 140,000 ETH, equivalent to $350 million, have been removed from exchanges.

This trend indicates a shift towards long-term holding rather than active trading.

With a reduced supply of ETH on exchanges, the potential selling pressure is decreasing, strengthening the case for a bullish breakout.”

Stay updated with the latest news on X, follow us on Facebook and join our Telegram channel.

Subscribe to our email alerts to receive the latest updates directly to your inbox.

Image Credit: Midjourney

]]> https://bitcoinplatform.com/ethereum-eyes-3000-breakout-as-analysts-highlight-key-2570-level/feed/ 0