Notifications
Clear all
Topic starter
20/08/2026 5:26 pm
TL;DR: Koske malware demonstrates how AI-shaped tradecraft can blend polyglot image lures, in-memory execution, rootkit concealment, and persistence changes to turn Linux endpoints into cryptomining infrastructure, according to Wazuh. The pattern reinforces that detection on Linux now depends on process, file, and configuration telemetry tied to identity-adjacent execution paths, not signature-only hunting.
NHIMG editorial — based on content published by Wazuh: Koske malware detection on Linux endpoints using Wazuh
By the numbers:
- Koske is designed to mine more than 18 cryptocurrencies using both CPU and GPU resources on infected Linux endpoints.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when Linux cryptominers hide inside seemingly harmless files?
A: Traditional file reputation and extension-based filtering break down because the payload is no longer where the user thinks it is.
Q: Why do cryptominers on Linux often survive standard endpoint monitoring?
A: They rely on startup file edits, systemd services, hidden helper files, and rootkit-like concealment to keep running after reboot or login.
Q: How do security teams know whether Linux workload execution is actually under control?
A: Look for evidence that code only runs from approved paths, that service and shell startup files are stable, and that suspicious egress is tied to known miner infrastructure.
Practitioner guidance
- Harden development environments used for Linux payload delivery Review JupyterLab and similar web-based development platforms for exposure, weak access controls, and unnecessary internet reachability.
- Monitor persistence locations that attackers actually use Add detections for .bashrc changes, systemd service creation, LD_PRELOAD manipulation, and hidden files under shared memory locations such as /dev/shm/.hiddenpid.
- Correlate endpoint execution with outbound mining traffic Create detection logic that links process creation, miner binary drops, and TCP connections to known mining pools.
What's in the full article
Wazuh's full blog post covers the operational detection detail this post intentionally leaves for the source:
- Step-by-step Wazuh decoder and rule configuration for SysmonForLinux telemetry on Ubuntu endpoints
- Custom rootcheck signatures for Koske artefacts such as hidden PID files, preload manipulation, and modified bash profiles
- CDB list setup for known Koske SHA256 hashes and the alert rule that matches new or modified files
- Dashboard workflow for filtering threat hunting events and validating the generated alerts
👉 Read Wazuh's analysis of Koske malware detection on Linux endpoints →
Koske malware on Linux endpoints: what detection teams need to catch?
Explore further
20/08/2026 6:15 pm
Polyglot delivery is a governance failure, not just a malware trick. When a JPEG can carry executable payloads, file-type trust collapses and conventional user education is irrelevant. The real issue is that defenders still treat content format as a proxy for safety, even though execution depends on parser behaviour, not file extension. Practitioners should treat suspicious polyglots as an integrity and provenance problem across the endpoint pipeline.
A question worth separating out:
Q: Who is accountable when a compromised Linux environment becomes a mining platform?
A: Accountability usually sits with the team that owns the development or workload environment, but the governance failure is shared across platform, security, and identity owners. If access, execution, and persistence controls were not explicitly assigned and reviewed, the organisation as a whole owns the risk.
👉 Read our full editorial: Koske malware shows how cryptojacking hides inside Linux trust paths
