New Stealthy Linux Malware Merges Mirai-based DDoS Botnet with Fileless Cryptominer

Cybersecurity researchers have identified a sophisticated Linux campaign that incorporates both legacy botnet capabilities and modern evasion techniques.

A newly discovered Linux malware campaign is demonstrating advanced threat actor tactics by combining Mirai-derived distributed denial-of-service (DDoS) capabilities with a stealthy, fileless cryptocurrency mining operation.

Research from Cyble Research & Intelligence Labs (CRIL) indicates that the multi-stage attack targets x86_64, ARM, and MIPS architectures, using advanced evasion techniques such as process masquerading, raw socket scanning, and dynamic runtime configuration.

The campaign, tracked by CRIL analysts, represents a hybrid monetization strategy increasingly adopted by modern threat actors. The operators leverage compromised systems for both DDoS attacks and cryptomining simultaneously, maximizing their returns.

The attack initiates with a shell script known as the "Universal Bot Downloader," which identifies the target system’s CPU architecture using the uname -m command. Based on this reconnaissance, the script downloads an architecture-specific binary from the server at 103.149.93[.]224.

The payload is stored in the /tmp directory, given executable permissions, and launched immediately, a common tactic among IoT and cloud-targeting botnets for rapid deployment.

The second-stage payload, named Mddos.x86_64 , is a statically linked, UPX-packed ELF binary with stripped symbols, complicating static analysis. Upon execution, it gathers kernel and architecture details, checks process limits, and registers the victim machine with its command-and-control infrastructure.

Once initialized, the malware enters stealth mode by masquerading as the legitimate systemd-logind system daemon. It attempts to modify its command line appearance through kernel protections may prevent this modification. The malware detaches from any terminal and runs silently in the background.

The botnet spawns multiple worker threads for attack operations, watchdog supervision, and C2 communication. It establishes a TCP listener on 127.0.0.1:63841 for internal inter-process communication, blending with legitimate system daemon traffic.

Raw Socket Scanning and C2 Communication

This variant uses raw TCP sockets for high-speed SSH scanning, spraying SYN packets to port 22 across numerous targets. This behavior aligns with Mirai-derived botnet families known for internet-wide SSH scanning.

Simultaneously, the malware creates standard TCP sockets with keepalive options for persistent C2 connections. Multiple worker threads resolve the C2 domain www.baojunwakuang[.]asia via Google Public DNS (8.8.8.8), ensuring resilient command channels while executing parallel attacks.

The third stage deploys a concealed XMRig-based Monero miner using stealth techniques. The loader fetches a UPX-packed XMRig binary from the C2 server and stores it in /tmp/.dbus-daemon , blending with legitimate processes. Configuration is received dynamically at runtime, avoiding on-disk artifacts.

During execution, the miner connects to the C2 server and requests configuration data, receiving a JSON containing pool URLs, wallet addresses, algorithm specifications, and thread counts. This dynamic rotation of mining parameters complicates detection and attribution.

This campaign highlights the convergence of traditional botnet capabilities with modern cryptomining operations. The combination of DDoS functionality with XMRig-based mining reflects the focus on maximizing return on investment from compromised devices.

Organizations operating Linux servers, cloud workloads, or exposed IoT devices face increased risks from such hybrid threats that can disrupt services and consume computational resources.

Based on reporting by GBHackers.