Linux Systems and IoT Devices Under Attack in New Cryptocurrency Mining Campaign

A new cryptocurrency mining campaign is targeting Linux systems and IoT devices, using a backdoor that deploys a range of tools and components to steal device resources for mining operations. Misconfigured Linux hosts are brute-forced to gain initial access, following which the threat actors move to disable shell history and fetch a trojanized version of OpenSSH from a remote server. The operation has been traced back to an actor named asterzeu, who has offered the toolkit for sale on the malware-as-a-service market.