Threat Source newsletter (Dec. 3, 2020)
Summary: Cisco Talos reported discovering a cryptocurrency-mining botnet it calls "Xanthe" that attempted to compromise one of Cisco's Docker-related honeypots, starting with a downloader module that pulls a main installer also tasked with spreading across local and remote networks. The main payload is a variant of the XMRig Monero miner protected by a shared object designed to hide the miner's process from process-enumeration tools, while two bash scripts terminate security services, remove competing botnets, and create cron jobs and startup-script changes for persistence.
Why it matters: The Xanthe miner hides its process from the enumeration tools defenders rely on and steals client-side certificates to spread to other hosts without needing a password, so a single compromised Docker host can seed the rest of your network.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026