New Stealthy Linux Malware Combines Mirai-Derived DDoS Botnet and Fileless Cryptominer
Security researchers have identified a new Linux malware campaign that integrates Mirai-derived DDoS botnet functionalities with a fileless cryptominer, marking a significant development in threats targeting IoT and cloud environments.
Security researchers have identified a new Linux malware campaign that integrates Mirai-derived DDoS botnet functionalities with a fileless cryptominer, marking a significant development in threats targeting IoT and cloud environments.
The malware, named V3G4 by Cyble Research Intelligence Labs, uses a multi-stage infection process to compromise Linux servers and IoT devices across various architectures, maintaining persistent access for both denial-of-service attacks and cryptocurrency mining activities.
This dual-purpose approach allows threat actors to optimize financial gains by utilizing infected devices for simultaneous operations, establishing a continuous revenue stream that evolves with new techniques, attack vectors, and evasion strategies.
The attack initiates with a shell script known as Universal Bot Downloader, which automatically detects the victim system's CPU architecture through the uname -m command.
Based on the identified architecture—supporting x86_64, ARM64, ARM7, ARM5, MIPS, and MIPSEL variants—the script constructs a download URL and retrieves the corresponding bot binary from a server controlled by the attacker at 103.149.93.224.
The payload is stored in the /tmp directory, granted executable permissions via chmod, and executed immediately, following traditional IoT botnet deployment methods focused on speed and compatibility across diverse Linux environments.
Once executed, the UPX-packed binary collects system information through environment reconnaissance, checking kernel details and process limits to establish operational parameters.
The malware establishes a sophisticated command-and-control infrastructure that combines raw TCP socket scanning with DNS-based resilience.
Cyble security analysts noted that the malware displays a signature banner "xXxSlicexXxxVEGA" to stdout, aligning with behavioral patterns observed in V3G4-Mirai strains previously documented in cloud infections.
The bot then enters a stealth mode by attempting to mimic the legitimate systemd-logind daemon using prctl system calls, closing standard I/O streams, and detaching from the controlling terminal with setsid to avoid visible process tracking and suspicion.
The malware establishes a sophisticated command-and-control infrastructure that combines raw TCP socket scanning with DNS-based resilience.
Multiple worker threads perform high-speed SYN packet spraying on port 22 across the internet, facilitating rapid SSH brute-force propagation to new targets.
Simultaneously, the bot conducts multi-threaded DNS queries against Google's public DNS server (8.8.8.8) to resolve the C2 domain baojunwakuang.asia, which maps to 159.75.47.123 and serves both botnet commands and miner configuration through non-standard ports like 60194 for enhanced stealth.
Infection Mechanism and Stealth Architecture
The third-stage payload deploys a covert XMRig-based Monero miner, focusing on detection evasion. Instead of embedding static configuration files, the malware retrieves mining parameters dynamically from the C2 server at runtime.
The loader disguises the miner as /tmp/.dbus-daemon to blend with legitimate processes and requests configuration data via TCP, receiving a JSON blob with wallet addresses, pool URLs, and algorithm settings without creating on-disk artifacts.
This fileless approach allows operators to adjust mining parameters in real-time while hindering forensic analysis.
The combination of masqueraded processes, raw socket scanning, and dynamic configuration delivery showcases how modern botnets maximize stealth and monetization in compromised Linux environments.
Based on reporting by Cyber Security News.