Group-IB reports Linux campaign that hid access behind cryptomining

Group-IB says attackers in a Linux campaign used cryptomining as cover while abusing Pluggable Authentication Module, the component that handles authentication, to retain access. The attackers also ran payloads that removed themselves from disk after execution, leaving less evidence for investigators. The finding affects security teams that might close a cryptomining alert after removing the miner. Group-IB says the underlying problem is misuse of legitimate administrative access, which cannot be resolved by patching a software flaw alone.