CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

PAM-impersonation Monero-mining campaign

campaign · campaign:groupib-xmrig-pam-forensic-smokescreen single-source

Covert Monero-mining intrusion documented by Group-IB (published 2026-07-30, activity observed May 2026). Initial access came through a trusted third-party relationship; after escalating to root the operator abused the pam_rootok policy to assume the identities of multiple low-privileged users without their passwords, planted redundant cron persistence across those unmonitored accounts, stopped core logging services, tampered with authentication logs, and ran a self-unlinking payload entirely from memory.

Coverage
1
first 2026-08-10 → last 2026-08-10
Latest activity
2026-08-10
Root escalated once, then spent the intrusion impersonating ordinary users so the audit trail would look…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, technology · regions: europe
Sources cited
1
1 hosts

Defender insights

What each entry about PAM-impersonation Monero-mining campaign tells a defender to do, newest first.

2026-08-10NOTABLERoot escalated once, then spent the intrusion impersonating ordinary users so the audit trail would look ordinary

Triage

Story timeline

  1. 2026-08-10An intruder used pam_rootok to move between low-privileged identities as a deliberate forensic smokescreen, inverting what a responder infers from the authentication trail
    active-threatsRoot escalated once, then spent the intrusion impersonating ordinary users so the audit trail would look ordinary

Hunting pivots

Tags
botnetcryptocrimeorganized-crimesupply-chain
ATT&CK techniques (6 across 7 tactics)

6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessTrusted Relationship
  • ExecutionScheduled Task/Job: Cron
  • PersistenceScheduled Task/Job: Cron · Modify Authentication Process: Pluggable Authentication Modules
  • Privilege EscalationScheduled Task/Job: Cron
  • StealthObfuscated Files or Information: Fileless Storage · Masquerading: Match Legitimate Resource Name or Location
  • Defense ImpairmentModify Authentication Process: Pluggable Authentication Modules · Disable or Modify Tools: Clear Linux or Mac System Logs
  • Credential AccessModify Authentication Process: Pluggable Authentication Modules

Initial Access TA0001

T1199Trusted Relationship×1

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

Execution TA0002

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

Persistence TA0003

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

T1556.003Modify Authentication Process: Pluggable Authentication Modules×1

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

Privilege Escalation TA0004

T1053.003Scheduled Task/Job: Cron×1

Adversaries may abuse the <code>cron</code> utility to perform task scheduling for initial or recurring execution of malicious code. The <code>cron</code> utility is a time-based job scheduler for Unix-like operating systems. The <code> crontab</code> file contains the schedule of cron entries to be run and the specified times for execution. Any <code>crontab</code> files are stored in operating system-specific file paths.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

Stealth TA0005

T1027.011Obfuscated Files or Information: Fileless Storage×1

Adversaries may store data in "fileless" formats to conceal malicious activity from defenses. Fileless storage can be broadly defined as any format other than a file. Common examples of non-volatile fileless storage in Windows systems include the Windows Registry, event logs, or WMI repository. Shared memory directories on Linux systems (`/dev/shm`, `/run/shm`, `/var/run`, and `/var/lock`) and volatile directories on Network Devices (`/tmp` and `/volatile`) may also be considered fileless storage, as files written to these directories are mapped directly to RAM and not stored on the disk.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

Defense Impairment TA0112

T1556.003Modify Authentication Process: Pluggable Authentication Modules×1

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

T1685.006Disable or Modify Tools: Clear Linux or Mac System Logs×1

Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs. The majority of native system logging is stored under the `/var/log/` directory. Subfolders in this directory categorize logs by their related functions, such as:

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

Credential Access TA0006

T1556.003Modify Authentication Process: Pluggable Authentication Modules×1

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is <code>pam_unix.so</code>, which retrieves, sets, and verifies account authentication information in <code>/etc/passwd</code> and <code>/etc/shadow</code>.

Evidence: 2026-08-10/pam-rootok-identity-shuffle-as-anti-forensics-xmrig · ATT&CK page ↗

Entries about PAM-impersonation Monero-mining campaign (1)

2026-08-10 · view entry permalink →

NOTABLENATOB2

An intruder used pam_rootok to move between low-privileged identities as a deliberate forensic smokescreen, inverting what a responder infers from the authentication trail

Group-IB's incident-response team has published a May 2026 intrusion whose interesting half is not the cryptominer it ended in but the reasoning behind how the operator moved (Group-IB, 2026-07-30). Initial access "was achieved by exploiting a trusted third-party relationship" (a standard user account inherited from a trusted environment) after which the actor escalated to root.

At that point the operator did something most intrusions do not: it stopped acting like root. Group-IB records that the attacker abused the pam_rootok policy so that su would assume the identities of multiple low-privileged users across the system without needing their passwords. pam_rootok is a legitimate, widely shipped PAM module whose entire purpose is to let the root user authenticate as anyone without a credential, nothing was exploited to make it work. What it buys the attacker is that the actions which follow appear in the authentication and audit trail as ordinary users doing ordinary things, rather than as root, which is the activity class a SOC alerts on.

The persistence design follows the same logic. Redundant cron jobs were planted across those low-privileged, unmonitored accounts, so that (in Group-IB's words) "if SOC analysts only remediated the root compromise, the botnet implant would simply regenerate from the shadowed accounts." That is an explicit bet against the standard remediation instinct of fixing the privileged account and closing the case. Alongside it, core logging services were stopped and authentication logs tampered with, and the payload unlinks its own binary immediately after taking a mutex, so it "transitions into a fileless state, running entirely from memory (RAM)."

The transferable point for this constituency is about inference, not about miners. A responder reading an authentication trail normally treats a session under a low-privileged account as evidence of limited privilege; here that inference is exactly backwards, and the identity in the log is a costume. Any Linux estate reached through a supplier or managed-service relationship (the initial-access shape Group-IB names) inherits the same exposure.

Detection, telemetry class first. Group-IB names the anchor itself: authentication and audit records showing root rapidly transitioning into standard user accounts, specifically session-start events associated with pam_rootok, should alert. Two supporting classes matter as much. Service-state telemetry showing the system logging or auditing daemon stopping or being modified without a corresponding change record is a signal in its own right rather than a maintenance artefact, which is why forwarding to an external, tamper-resistant collector in real time is what preserves the evidence at all. And scheduled-job telemetry across ordinary user accounts (not just privileged ones) is where the redundant persistence lives. Triage: administrators legitimately use su to operate as service accounts, and cron jobs under application accounts are normal; the discriminator is direction and tempo, root descending into several unrelated low-privileged identities in quick succession, with no corresponding administrative task, followed by new cron entries under those same accounts. A single su is noise; the fan-out is the signal.

Initial access was achieved by exploiting a trusted third-party relationship, highlighting critical supply chain risks.

By distributing their malicious activities and planting redundant cronjob persistence across various unmonitored standard accounts, the attackers ensured that if SOC analysts only remediated the root compromise, the botnet implant would simply regenerate from the shadowed accounts.

Immediately after establishing this mutex, the malware performs a self-unlink operation. By deleting its own binary file from the disk while the process remains active, the malware transitions into a fileless state, running entirely from memory (RAM).

Alerts should be triggered immediately if root is observed rapidly transitioning into standard user accounts (USER_START events associated with pam_rootok).

The malware natively supports process masquerading via the custom -h flag, allowing it to spoof legitimate process names such as "ssh" in ps, top, and /proc/<pid>/comm outputs.

Group-IB 2026-07-30
threat10 Aug 04:47Zsingle-sourceOpen finding →
Sources: Group-IB

explore in graph

Where this entity is cited

  • Threats1

Source distribution

  • group-ib.com1 (100%)
All cited sources (1)