← Back to feed
Threat Actors & CampaignsEmerging1 sourceJul 30, 2026 · 07:11via Group-IB

XMRig Covert Ops: The Cryptomining Campaign That Abuses Trusted Access and Deploys Forensic Smokescreens

Brief

Dive into a covert Linux XMRig campaign exploiting trusted access, weaponizing PAM to create forensic smokescreens, and deploying self-unlinking payloads.

Read more on Group-IB