Cryptojacking on Linux: Sophisticated Rootkit Attack Deploys Hidden Miner and Spreads via SSH
A recent investigation by the cybersecurity team at ANY.RUN has unveiled a covert Linux attack that leverages a powerful rootkit named Diamorphine to stealthily install and run a cryptocurrency miner. This campaign marks another alarming instance of threat actors weaponizing open-source software in increasingly evasive ways.
Deep Dive: Multi-Layered Malware Operation
Disguised as a benign Python file, the initial dropper kicks off a multi-phase intrusion. It quietly installs system dependencies, shuts down rival mining software to secure system resources, and retrieves several malicious components online—including a crypto miner (python-3.7.3.so), an auxiliary payload (cloud), and the rootkit bundle (python37.tar).
Diamorphine, a Loadable Kernel Module (LKM), is engineered to support a wide range of Linux kernel versions (2.6.x to 6.x) and CPU architectures, including x86, x86_64, and ARM64. Once installed, it hooks into system-level processes, making the malware nearly impossible to detect with standard tools.
To maintain persistence, the script replaces core Linux utilities like /bin/ps and registers a systemd service, ensuring the miner relaunches after each reboot. For stealth, it manipulates kernel structures, making it invisible to commands such as lsmod or rmmod, and uses list_del to erase its tracks from the module list.
Autonomous Spread and Log Evasion
Beyond mining, the malware engages in lateral movement by harvesting SSH keys from the infected system and using them to jump to other machines in the network. It then purges system logs, significantly reducing the chance of post-incident forensic recovery.
The attacker’s use of a three-pronged stealth tactic—process obfuscation, kernel module concealment, and system call interception—makes this campaign especially difficult to detect and mitigate.
Open-Source Tools: A Double-Edged Sword
The components used in this campaign, including the rootkit and miner, originate from publicly available code repositories. Diamorphine itself, originally maintained by GitHub user “m0nad,” exemplifies how open-source transparency can be exploited for malicious gain.
This tactic is part of a broader trend where open-source utilities are co-opted by attackers to lower development overhead and increase sophistication. The miner even kills off rival mining operations, indicating a crowded underground economy competing for compute power.
ANY.RUN Analysis: In-Depth Threat Visibility
By deploying this malware inside a controlled Linux virtual machine, ANY.RUN researchers were able to capture detailed behavioral data and process traces. They’ve released IOCs and TI Lookup data to support defenders in proactively detecting emerging variants.
Security Recommendations
To counter threats like this, ANY.RUN suggests:
- Using behavioral sandboxing for malware analysis.
- Monitoring SSH usage for anomalies and credential theft.
- Isolating critical infrastructure and enforcing secrets management using tools like HashiCorp Vault or GitHub Actions Secrets.
- Scanning for hardcoded keys and tokens in source code using utilities such as TruffleHog.
- Regularly auditing binaries and replacing tampered system files.
Conclusion: Linux Isn’t Immune
This incident reinforces that Linux systems—central to cloud servers, IoT, and critical workloads—are no longer a niche target. With rootkits like Diamorphine providing deep concealment and persistence, defenders must prioritize visibility, hardening, and detection strategies tailored to Unix-based environments.
