Threat actors are exploiting Linux Pluggable Authentication Modules (PAM) to deploy and conceal XMRig cryptocurrency miners on compromised systems. This sophisticated campaign uses modified PAM libraries to establish persistence, evade detection, and maintain unauthorized cryptomining operations. The malware targets SSH services, injecting malicious code into the authentication stack to survive reboots and avoid traditional detection methods. Organizations running Linux infrastructure face resource theft, performance degradation, and potential lateral movement risks.
Introduction
A new cryptomining campaign has emerged that demonstrates advanced evasion capabilities by abusing Linux Pluggable Authentication Modules (PAM). Security researchers have identified threat actors deploying XMRig cryptocurrency miners through compromised PAM configurations, allowing the malware to deeply embed itself within the operating system’s authentication framework.
Unlike traditional cryptomining malware that relies on cron jobs or systemd services, this campaign manipulates PAM—a core authentication mechanism used across virtually all Linux distributions. By poisoning PAM modules, attackers achieve remarkable persistence and stealth, making detection and removal significantly more challenging for security teams.
The campaign represents an evolution in cryptojacking techniques, showcasing how adversaries are moving beyond basic deployment methods to exploit fundamental system components. This approach not only ensures the miner survives standard cleanup efforts but also provides attackers with additional capabilities for credential harvesting and backdoor access.
Background & Context
Pluggable Authentication Modules (PAM) is a flexible authentication framework used in Linux and Unix-like systems since the mid-1990s. PAM separates authentication logic from applications, allowing system administrators to configure authentication policies through modular libraries located in /lib/security/ or /lib64/security/.
When users authenticate via SSH, login, or other services, PAM modules are loaded in sequence according to configuration files in /etc/pam.d/. Each module can perform various functions including password verification, session management, account validation, and password changes. This modular architecture makes PAM powerful but also presents an attractive target for adversaries.
XMRig is a legitimate, open-source Monero cryptocurrency miner that has been weaponized by cybercriminals since 2017. Its popularity among threat actors stems from its efficiency, cross-platform support, and ease of configuration. Monero’s privacy-focused blockchain makes it ideal for illicit mining operations, as transactions cannot be easily traced.
Previous cryptomining campaigns typically relied on visible processes, scheduled tasks, or container escapes. The shift toward PAM abuse represents a significant tactical evolution, borrowing techniques from advanced persistent threat (APT) groups that have historically targeted authentication mechanisms for espionage rather than financial gain.
Technical Breakdown
The attack chain begins with initial compromise, typically through SSH brute-force attacks, exploitation of vulnerable services, or credential stuffing. Once access is established, attackers deploy a malicious PAM module designed to blend with legitimate authentication libraries.
The compromised PAM module, often disguised with names resembling legitimate libraries (e.g., pam_unix2.so or pam_systemd.so), is placed in /lib/security/ or /lib64/security/. The attackers then modify PAM configuration files, particularly /etc/pam.d/sshd or /etc/pam.d/common-session, to reference this malicious module.
A typical malicious PAM configuration entry looks like:
session optional pam_systemd.soThe trojanized PAM module contains embedded functionality that executes during the session phase of authentication. When any user logs in, the module triggers, launching the XMRig miner as a background process. The implementation includes several evasion techniques:
Process Masquerading: The miner process is often renamed to mimic legitimate system processes like [kworker/0:1] or /usr/lib/systemd/systemd --user, making it difficult to identify in process listings.
Resource Throttling: The miner is configured to consume CPU resources conservatively (typically 50-70% of available capacity) to avoid triggering performance alerts or user suspicion.
Network Obfuscation: Communication with mining pools occurs over encrypted channels, often using TLS to blend with legitimate HTTPS traffic. Some variants implement domain generation algorithms (DGAs) or use compromised legitimate servers as proxies.
The malicious PAM module also typically includes backdoor functionality:
// Simplified example of malicious PAM module code
PAM_EXTERN int pam_sm_open_session(pam_handle_t *pamh, int flags,
int argc, const char **argv) {
// Legitimate-looking PAM operations
if (fork() == 0) {
// Child process launches miner
execl("/tmp/.hidden/xmrig", "[kworker/0:1]", "-o", "pool.address", NULL);
}
return PAM_SUCCESS;
}Some variants implement credential harvesting capabilities, logging usernames and passwords to files in hidden directories like /tmp/... (with literal dots) or /dev/shm/.cache/.
Impact & Risk Assessment
The weaponization of PAM for cryptomining operations creates multiple risk vectors beyond simple resource theft:
Performance Degradation: Infected systems experience elevated CPU utilization, leading to slowdowns in legitimate workloads, increased cloud computing costs, and potential service disruptions. In containerized environments, resource exhaustion can affect multiple tenants.
Increased Energy Costs: Organizations face inflated electricity bills from sustained high CPU usage, particularly problematic for on-premises data centers and edge computing deployments.
Detection Evasion: Traditional endpoint detection tools may miss PAM-level compromises, as the malware operates within trusted system components. Process monitoring often fails to flag the activity due to effective masquerading.
Credential Exposure: Many variants include keylogging or credential harvesting capabilities, creating secondary risks of account compromise, privilege escalation, and lateral movement across the network.
Persistence: PAM-based malware survives system reboots, software updates, and many remediation efforts. Complete removal requires identifying and purging malicious modules from the authentication stack.
Lateral Movement: Compromised systems serve as footholds for broader network infiltration. Attackers with persistent PAM access can deploy additional payloads, establish C2 channels, or pivot to other systems.
Organizations in cloud, hosting, and managed service provider sectors face particularly acute risks, as resource theft directly impacts operational costs and customer experience.
Vendor Response
Linux distribution maintainers have issued advisories recommending administrators audit PAM configurations and verify the integrity of PAM modules. Red Hat, Ubuntu, Debian, and SUSE have all published guidance on detecting unauthorized PAM modifications.
Package management systems have implemented enhanced integrity checking for security-critical directories. Modern distributions now include file integrity monitoring (FIM) capabilities that alert on unauthorized changes to /etc/pam.d/ and /lib/security/.
Cloud service providers including AWS, Google Cloud, and Azure have updated their security monitoring capabilities to detect anomalous PAM modifications and cryptomining indicators. Several have issued customer notifications regarding this threat vector.
Security vendors have updated endpoint detection and response (EDR) solutions with specific signatures for PAM-based cryptominers. YARA rules and indicators of compromise (IOCs) have been shared through threat intelligence platforms.
However, no single vendor provides complete protection, as the attack leverages legitimate system functionality. Defense requires layered controls and proactive monitoring rather than relying solely on signature-based detection.
Mitigations & Workarounds
Organizations should implement multiple defensive layers to protect against PAM-based cryptomining:
Verify PAM Integrity: Audit all PAM modules and configurations:
# List all PAM modules
find /lib/security /lib64/security -name "*.so" -ls
# Compare against package manifests
rpm -Va | grep pam # Red Hat/CentOS
debsums -c libpam-modules # Debian/Ubuntu
# Check PAM configuration files
find /etc/pam.d -type f -exec ls -l {} \;
Implement File Integrity Monitoring: Deploy tools like AIDE, Tripwire, or OSSEC to detect unauthorized modifications:
# Example AIDE configuration
aide --init
aide --checkHarden SSH Access: Reduce attack surface by implementing key-based authentication, disabling password authentication, and using fail2ban:
# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin noMonitor Process Activity: Look for suspicious processes with unusual names or resource consumption:
# Identify high CPU processes
top -b -n 1 | head -20
# Check for hidden processes
ps auxf | grep -E "xmrig|minerd|cpuminer"
# Monitor network connections
netstat -plant | grep ESTABLISHED
Restrict PAM Module Loading: Use SELinux or AppArmor to control which processes can modify PAM:
# SELinux context verification
ls -Z /lib/security/*.soDetection & Monitoring
Security teams should implement continuous monitoring for indicators of PAM compromise:
File System Monitoring: Alert on any modifications to /etc/pam.d/ and PAM module directories. Unexpected changes to these locations warrant immediate investigation.
Process Behavioral Analysis: Monitor for processes exhibiting cryptomining characteristics:
# Check for mining pool connections
netstat -plant | grep -E ":3333|:4444|:5555|:7777|:8080"
# Identify processes with suspicious parent/child relationships
pstree -p | grep -A5 sshd
Network Traffic Analysis: Inspect outbound connections for mining pool communication patterns. Common mining pools use ports 3333, 4444, 5555, and 8080. DNS queries for known mining pool domains serve as early indicators.
System Resource Metrics: Establish baselines for CPU utilization and alert on sustained elevated usage without corresponding legitimate workload increases.
Authentication Log Analysis: Review /var/log/auth.log or /var/log/secure for unusual authentication patterns, failed login attempts, or PAM errors:
# Check authentication logs
grep pam /var/log/auth.log | tail -50
# Identify PAM module loading
grep "pam_.*open_session" /var/log/auth.log
Hash Verification: Regularly compare PAM module hashes against known-good values:
# Generate and compare checksums
sha256sum /lib/security/*.so > pam_checksums.txt
# Compare against baselineBest Practices
Organizations should adopt comprehensive security practices to minimize exposure:
Implement Least Privilege: Limit SSH access to only necessary accounts and systems. Use jump hosts or bastion servers to control administrative access.
Deploy Multi-Factor Authentication: Require MFA for all SSH connections to prevent credential-based compromises.
Regular Security Audits: Conduct periodic reviews of PAM configurations, installed modules, and authentication logs.
Network Segmentation: Isolate critical systems and limit outbound network access to only required destinations. Block mining pool domains and IP addresses at the network perimeter.
Patch Management: Maintain current patch levels for all system components to reduce initial compromise vectors.
Security Awareness: Train administrators to recognize signs of system compromise including unexpected performance degradation and suspicious processes.
Incident Response Planning: Develop and test procedures for detecting, containing, and remediating cryptomining infections.
Immutable Infrastructure: Where possible, use immutable infrastructure patterns where systems are replaced rather than patched, reducing persistence opportunities.
Key Takeaways
- Threat actors are abusing PAM to achieve deep persistence for cryptomining operations
- The technique survives reboots and evades traditional detection methods
- XMRig miners are deployed through malicious PAM modules loaded during authentication
- Organizations face resource theft, performance issues, and potential credential compromise
- Detection requires file integrity monitoring, process analysis, and network traffic inspection
- Mitigation involves PAM hardening, SSH access controls, and continuous monitoring
- This campaign represents tactical evolution toward exploiting fundamental system components
- Complete remediation requires identifying and removing malicious PAM modules
References
- Linux PAM Documentation: http://www.linux-pam.org/
- XMRig GitHub Repository: https://github.com/xmrig/xmrig
- MITRE ATT&CK T1556.003: Modify Authentication Process – Pluggable Authentication Modules
- MITRE ATT&CK T1496: Resource Hijacking
- Red Hat Security Advisory: Securing PAM Configurations
- SANS Internet Storm Center: PAM Backdoor Detection Techniques
Stay updated at https://cydhaal.com — Your Daily Dose of Cyber Intelligence.
📧 Subscribe to our newsletter at https://cydhaal.com/newsletter/
