Scworld New Linux Malware Combines Mirai Botnet with Fileless Cryptominer
Article Content
Browse articles 
Researchers have identified a new Linux malware that merges the Mirai botnet's DDoS capabilities with a fileless cryptominer. This sophisticated threat employs advanced techniques such as raw-socket scanning and dynamic DNS resolution to evade detection, enabling both network disruption and financial gain. The malware utilizes a multi-stage infection chain, starting with a downloader for Mirai.
Ask AI about this cluster
Answers cite the sources they use
Updated 228d ago How this analysis works
More articles in this cluster (2)
Following this threat?
Track Mirai in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical PHP Vulnerabilities Exploited Before Public Disclosure Two critical vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619, were exploited before their public disclosure on October 21, 2026. Amazon Threat Intelligence reported that attempts to exploit these vulnerabilities began on October 17, 2026, targeting its MadPot honeypot network. Both… 
Cling Botnet Exploits Realtek SDK Flaw Using STUN Traffic for C2 The Cling botnet has been identified as exploiting a critical vulnerability (CVE-2021-35394) in the Realtek Jungle SDK, allowing attackers to deploy malware that disguises command-and-control (C2) traffic as legitimate STUN protocol exchanges. This vulnerability, which has a CVSS score of 9.8, was first exploited…