Critical

Cryptomining campaign avoids root access to evade detection

SCM feed for Latest

July 31, 2026 at 2:17 PM

Actively Exploited

Overview

A cryptomining campaign discovered by Group-IB in May 2026 is using a modified version of the XMRig miner to avoid detection. This campaign is notable for not requiring root access on infected machines, which makes it harder for security software to identify the malicious activity. By evading traditional detection methods, the attackers can continue to mine cryptocurrencies without being easily caught. This type of stealthy approach poses risks not only to individual users whose systems may be compromised but also to organizations that could suffer from reduced performance and increased energy costs. As cryptomining becomes more prevalent, it is crucial for users and companies to remain vigilant and implement security measures to protect against these types of attacks.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: XMRig miner, affected systems not specified
Action Required: Users should regularly update their security software and monitor system performance for unusual activity.
Timeline: Disclosed on May 2026

Original Article Summary

The campaign, identified in May 2026 by Group-IB, uses a modified XMRig miner.

Impact

XMRig miner, affected systems not specified

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on May 2026

Remediation

Users should regularly update their security software and monitor system performance for unusual activity. Implementing network monitoring solutions can also help detect unauthorized cryptomining activities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

Massive DDoS attack disrupts Norway’s government digital services

BleepingComputer

Norway's government digital services have been disrupted by a significant distributed denial-of-service (DDoS) attack that began on Monday. The attack has targeted the country's shared digital infrastructure, impacting various services utilized by public sector entities. As a result, users may experience difficulties accessing important government resources and services. This incident raises concerns about the security and reliability of government digital platforms, particularly in the face of increasing cyber threats. Authorities are working to mitigate the effects of the attack and restore normal operations as soon as possible.

Aug 25, 2026

Interpol targets Black Axe’s illicit financial web in latest international sting

CyberScoop

Interpol has launched a major international operation targeting the financial networks of the Black Axe criminal organization, which is involved in various illicit activities across multiple continents. This coordinated sting involved several countries and resulted in the seizure of millions of dollars in assets. Authorities also uncovered infrastructure that supports 'Crime-as-a-Service', indicating a sophisticated level of organization within Black Axe. This operation not only disrupts their financial operations but also highlights the ongoing global efforts to combat cybercrime. The implications of this sting are significant as it aims to dismantle a key player in the world of cybercrime, potentially reducing the threats posed to individuals and businesses worldwide.

Aug 25, 2026

From Fake Workers to Account Recovery: The Growing Identity Verification Risk

BleepingComputer

Attackers are shifting their focus from directly compromising login credentials to exploiting identity verification processes. This change in tactics poses significant risks, allowing bad actors to create fake identities or manipulate recovery procedures to gain unauthorized access. Organizations that rely on weak verification methods are particularly vulnerable to social engineering attacks, which can lead to data breaches and loss of sensitive information. Strengthening identity verification processes is essential to mitigate these risks and protect both employees and customers. Companies must adopt more robust methods to ensure that only legitimate users can access their systems, thereby reducing the chances of fraudulent activities.

Aug 25, 2026

INTERPOL crackdown on West African crime rings uncovers troubling new trend

Help Net Security

INTERPOL recently conducted an extensive operation called Jackal IV, targeting organized crime groups in West Africa. Over eight months, police in 22 countries arrested 58 individuals and identified 263 suspects linked to groups like Black Axe, known for their involvement in money laundering and other illicit activities. The operation aimed to disrupt these crime networks by seizing assets and facilitating arrests. This crackdown reveals a troubling trend of increasing organized crime activity in the region, which poses significant challenges for law enforcement and raises concerns about the broader impact on security and governance in West Africa. The collaboration across multiple countries underscores the need for a united front against such transnational crime.

Aug 25, 2026

Unpatched Calix router vulnerability allows remote attackers to expose home networks

SCM feed for Latest

A newly discovered vulnerability, identified as CVE-2026-75501, affects Calix routers running the EXOS/6.6.47 firmware. This flaw allows remote attackers to potentially expose home networks, raising significant security concerns for users of these devices. The issue lies in how the firmware handles certain requests, which could lead to unauthorized access to sensitive network data. Home users with these routers should be particularly vigilant, as this vulnerability could make their networks easier targets for cybercriminals. It's crucial for affected users to take immediate action to secure their devices and prevent potential breaches.

Aug 25, 2026

WhatsApp adds stronger two-step verification, multiple passkeys

BleepingComputer

WhatsApp is enhancing its account security with the introduction of multiple passkeys and a more robust two-step verification process. These features aim to provide users with better protection against unauthorized access to their accounts. The update is part of WhatsApp's ongoing efforts to improve security, especially as the platform continues to grow in popularity. Users will benefit from these added layers of security, making it harder for attackers to compromise their accounts. This move is particularly important given the increasing number of phishing attempts and account takeovers targeting messaging apps.

Aug 25, 2026