Privacy Ninja

New Worm Turns Windows, Linux Servers Into Monero Miners

New Worm Turns Windows, Linux Servers Into Monero Miners

A newly discovered and self-spreading Golang-based malware has been actively dropping XMRig cryptocurrency miners on Windows and Linux servers since early December.

This multi-platform malware also has worm capabilities that allow it to spread to other systems by brute-forcing public-facing services (i.e., MySQL, Tomcat, Jenkins and WebLogic) with weak passwords as revealed by Intezer security researcher Avigayil Mechtinger.

The attackers behind this campaign have been actively updating the worm’s capabilities through its command-and-control (C2) server since it was first spotted which hints at an actively maintained malware.

The C2 server is used to host the bash or PowerShell dropper script (depending on the targeted platform), a Golang-based binary worm, and the XMRig miner deployed to surreptitiously mine for untraceable Monero cryptocurrency on infected devices.

“The ELF worm binary and the bash dropper script are both fully undetected in VirusTotal at the time of this publication,” Mechtinger said.

Also Read: 10 Practical Benefits of Managed IT Services

ELF worm undetected in VirusTotal (Intezer)

Brute-forcing and exploiting exposed servers

The worm spreads to other computers by scanning for and brute-forcing MySql, Tomcat, and Jenkins services using password spraying and a list of hardcoded credentials.

Older versions of the worm were also seen trying to exploit the CVE-2020-14882 Oracle WebLogic remote code execution vulnerability.

Once it manages to compromise one of the targeted servers, it will deploy the loader script ( for Linux and ld.ps1 for Windows) that drops both the XMRig miner and Golang-based worm binary.

The malware will automatically kill itself if it detects that the infected systems are listening on port 52013. If the port is not in use, the worm will open its own network socket.

Windows dropper script (Intezer)

“The fact that the worm’s code is nearly identical for both its PE and ELF malware—and the ELF malware going undetected in VirusTotal—demonstrates that Linux threats are still flying under the radar for most security and detection platforms,” Mechtinger added.

To defend against brute force attacks launched by this new multi-platform worm you should limit logins and use hard to guess passwords on all Internet-exposed services, as well as two-factor authentication whenever possible.

Keeping your software up to date at all times and making sure that your servers aren’t reachable over the Internet unless absolutely necessary are other ways to defend against this new malware threat.

Also Read: Limiting Location Data Exposure: 8 Best Practices

Privacy Ninja provides GUARANTEED quality and results for the following CORE SERVICES:

DPO-As-A-Service (Outsourced DPO Subscription)
Vulnerability Assessment & Penetration Testing (VAPT)
PDPA Obligations for Organizational Compliance (SkillsFuture Credit Eligible)


PDPA Compliance Audit
ital Transformation Consultancy
Data Protection Trustmarks Certification Readiness Consultancy

PDPA Data Protection Software
Smart Contract Audit



Leave a Reply

Your email address will not be published. Required fields are marked *


Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.

Powered by WhatsApp Chat

× How can we help you?