"a forensic smokescreen," Group-IB wrote.
The intrusion chain: trusted third party to pam_rootok abuse
Group-IB’s investigation, published on July 30, traced a Monero mining campaign back to a May 2026 intrusion that began through a trusted third-party relationship. Operators escalated to root and then intentionally abandoned that high-profile account activity. Instead of staying at root, they abused the pam_rootok policy within Linux Pluggable Authentication Modules (PAM) to assume the identities of multiple standard accounts without needing those accounts’ passwords.
That move—impersonating low-privileged users after obtaining root—was deliberate: by scattering execution and persistence into accounts that SOCs were not watching, operators produced the pattern Group-IB called “a forensic smokescreen.”
Persistent deception: logs stopped, cron jobs scattered, implants regenerated
The campaign combined tampering with logging and account-level persistence to frustrate responders. Operators stopped core logging services and altered authentication logs, leaving few on-disk traces of the initial privilege escalation or the PAM manipulation that followed. They distributed redundant cron job persistence across multiple accounts so that cleanup focused on the root compromise would not prevent the implant regenerating from shadowed accounts.
The miner: a modified XMRig that self-deletes and runs entirely in memory
Group-IB identified the payload as a modified build of XMRig 6.25.0. The binary was cross-compiled with musl libc and carried a hardcoded banner identifying it as a private botnet version. On startup it creates a file mutex at /tmp/.lock so only one instance runs, then deletes its own binary from disk and continues running in memory—behavior the report noted leaves conventional disk scans clean.
Once resident, the miner reads the host’s CPU topology, interacts with kernel model-specific registers (MSR), allocates Huge Pages, and spawns worker threads to maximize hash rate. A companion bash script terminates competing miners. Configuration data was concealed behind layered XOR keys; after decryption the researchers found a hardcoded campaign identifier that Group-IB linked to a wider family used to aggregate hash rates across compromised hosts.
Process and network-level camouflage: masquerading and blending into web flows
Concealment went beyond accounts and logs. A custom flag in the implant enabled process masquerading: the malware spoofed legitimate process names such as ssh in listings. Group-IB mapped that behavior to MITRE technique T1564.013. On the network side, mining traffic used a Java/Agent user agent to make Stratum packets resemble ordinary web application flows and reduce the chance they would be flagged as unusual.
What this means for security teams, procurement leaders, and incident responders
- Security operations teams: The operators’ tactic of downgrading from root to standard accounts is intended to evade SOC alerts tied to high-privilege activity; teams will need to hunt beyond root-level indicators and monitor account-level cron jobs and transient artifacts such as /tmp/.lock.
- Procurement and vendor managers: The intrusion began through a trusted third-party relationship, which underscores the risk of cross-environment connections from vendors and clients; Group-IB specifically urged restricting such connections as part of containment and prevention.
- Incident responders: Because the miner self-unlinks and moves entirely into memory, conventional disk forensics will miss key artifacts; Group-IB emphasized that memory forensics—and forward, tamper-proof logging—are essential to detect and validate the compromise.
Group-IB’s operational recommendations and a closing observation
Group-IB concluded with three concrete mitigations: forward logs in real time to a tamper-proof external system; restrict cross-environment connections from vendors and clients; and hunt for transient artifacts such as the /tmp/.lock mutex. The report links these steps directly to the campaign’s core tradecraft—PAM manipulation, log tampering, process masquerading, and a self-deleting in-memory miner—because those techniques collectively reduce evidence on disk and normal event streams.
The campaign is a compact lesson in avoidance: operators moved deliberately from the obvious (root) to the obscure (unmonitored user accounts and memory-resident binaries), and paired that movement with process and network masquerade. For any organization that relies on outsourced access or that routes vendor traffic across production environments, Group-IB’s findings make one point plain—visibility and immutable, external logging are not optional if defenders hope to break the “forensic smokescreen.”
Original story (Group-IB / Infosecurity Magazine, July 30, 2026)
