Loading story…
Security researchers reported several distinct but related findings showing how attackers are abusing Linux-based infrastructure for botnets, cryptomining, and post-compromise operations. Eclypsium identified a new CondiBot variant labeled QTXBOT and a previously undocumented Monaco cryptominer targeting network devices and exposed SSH services, with Monaco using brute-force access and exfiltrating stolen credentials to a command-and-control server hosted on Alibaba Cloud Singapore. Separately, Hunt.io exposed an Iranian-operated relay and botnet environment through an open directory, revealing a 15-node tunnel network, SSH-based mass deployment tooling, on-host compilation of DDoS malware, and active command-and-control infrastructure.
Flare also documented how threat actors repeatedly use the legitimate open-source script Bench.sh after initial access to profile compromised systems, including JupyterLab, Jupyter Notebook, SSH, Apache Tomcat, and PHP-based environments, in order to assess CPU, memory, disk, and bandwidth for follow-on abuse such as cryptomining, proxying, or DDoS. The reporting does not describe a single shared intrusion campaign: the CondiBot/Monaco discovery, the Iranian botnet infrastructure exposure, and Bench.sh abuse are separate research items connected by the broader theme of attackers operationalizing compromised Linux and network infrastructure. A separate report on FancyBear/APT28 email theft and a general weekly security recap are different topics and should be excluded.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Darktrace researchers reported the first documented case of Chaos malware being adapted from routers and edge devices to target 64-bit Linux servers. The newly observed sample also added SOCKS5 proxy capability, suggesting uses beyond DDoS attacks and cryptomining.
On 2026-03-17, Hunt.io disclosed an exposed open directory on 185.221.239[.]162:8080 that revealed a threat actor's working environment, then pivoted from a shared Let's Encrypt certificate for *.server21[.]org to map a 15-node infrastructure across Iranian ISPs, Hetzner in Finland, and a related OVH node in London. The disclosure connected the relay network, DDoS activity, and botnet development to a single operator.
Hunt.io observed a subsequent phase in which the operator developed an SSH-based botnet using Python deployment scripts and a compiled C client that was built directly on victim hosts and renamed "hex" for persistence. The botnet relied on credential-based SSH access and reconnection logic to maintain infected systems.
The same exposed environment showed a later phase in which the operator compiled and used DDoS tools, including MHDDOS, indicating active attack operations beyond relay services. Researchers assessed this as a distinct escalation from infrastructure setup to offensive use.
Hunt.io found evidence that an Iran-based or Farsi-speaking operator first built a KCP-based Paqet tunnel network across infrastructure tied to Iranian ISPs and other hosting providers to support censorship-circumvention services. This was identified as the earliest operational phase visible in the exposed server files and shell history.
In a subset of the intrusions analyzed by Flare, attackers moved beyond reconnaissance and deployed follow-on payloads including a cryptominer and Mirai malware. Other compromises ended after benchmarking, suggesting Bench.sh was used as a triage step to judge host value.
Flare reported repeated real-world abuse of the legitimate Bench.sh benchmarking script after compromise of exposed services including JupyterLab, Jupyter Notebook, SSH, Apache Tomcat, and PHP applications. Attackers used the tool to quickly assess CPU, memory, disk, and bandwidth before deciding whether to monetize or further weaponize access.
On 2026-03-06, researchers documented two previously unreported Linux malware families targeting network devices: a new Mirai-derived CondiBot variant and a Go-based Monero miner called Monaco. The findings showed financially motivated actors increasingly targeting routers, firewalls, IoT devices, and similar infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcehunt.io
Open sourceflare.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New threat research described two distinct botnet operations expanding through mass compromise. Flare reported a previously undocumented Linux botnet it dubbed **SSHStalker**, observed via an SSH honeypot and characterized by *IRC-based* command-and-control with multiple bot variants (including legacy families such as **Tsunami** and **Keiten**), automated scanning and staging (including a Golang scanner masquerading as `nmap` behavior and a compile-and-run workflow), and noisy but effective persistence via `cron` jobs that can re-establish the bot within roughly a minute if not fully removed. The tooling also included log-tampering artifacts (e.g., `utmp/wtmp/lastlog` manipulation) and a “back-catalog” of older Linux 2.6-era exploits, suggesting the operator is targeting long-tail, poorly maintained infrastructure; Flare noted playbook similarities to **Outlaw/Maxlas**-style operations but did not claim definitive attribution. Separately, reporting on a Silent Push analysis described a large **SystemBC** (aka **Coroxy/DroxiDat**) botnet comprising **10,000+** infected IPs globally, with notable concentrations in the US and additional presence across Europe and Asia. SystemBC is described as **SOCKS5 proxy malware** commonly used by threat actors to mask downstream activity and historically associated with enabling ransomware deployment; the report highlighted infections linked to **government-related domains** based on passive DNS observations, indicating potential exposure of sensitive environments even when immediate follow-on payloads were not directly observed. A third article provided general technical background on how internet-wide scanners (e.g., Shodan/Censys-style platforms) perform active service identification and banner grabbing; it is contextual but does not report on either botnet operation specifically.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Multiple reports describe **distinct malware and intrusion campaigns** active across enterprise, government, developer, and consumer targets, rather than a single shared incident. The activity includes vishing-led abuse of *Quick Assist* for remote access and persistence, a **.NET AOT** malware chain delivering **Rhadamanthys** and **XMRig**, renewed **Horabot** banking Trojan activity using fake CAPTCHA and `mshta`, a compromised *Open VSX* extension that fetched **BlokTrooper** payloads, and a Middle East-focused Ramadan coupon lure delivering a **RAT** with AWS S3-based exfiltration. Additional reporting covers **Operation CamelClone**, which used government-themed spear-phishing and `LNK` files to steal data with *Rclone*, and **Contagious Trader**, a cryptocurrency-focused campaign tied to malicious GitHub and npm projects. One reference stands apart as vulnerability research rather than campaign reporting: watchTowr detailed **pre-authenticated RCE chains in BMC FootPrints**, which is a separate product security disclosure and not part of the malware operations described elsewhere. Because the references cover unrelated incidents, malware families, and victim sets, the material should **not** be treated as one cohesive event. It is also **not fluff**, as the sources contain substantive threat intelligence, technical analysis, exploit research, and incident tradecraft rather than marketing or generic advice.
Jun 29, 2026