Emerging malware campaign

Darktrace reports an emerging cryptojacking campaign named Qubitstrike that targets exposed Jupyter Notebooks, exfiltrates cloud credentials, and mines XMRig, using Discord as its command and control channel and deploying a Diamorphine rootkit to hide its tracks.

The campaign’s payloads are hosted on Codeberg, and after initial access via a Jupyter honeypot, the malware downloads a script (mi[.]sh) that retrieves the XMRig miner, registers cron persistence and inserts attacker-controlled SSH keys, and uses a Diamorphine kernel module or an LD_PRELOAD method to conceal its processes.

It hunts for credential files for AWS and Google Cloud and exfiltrates them via Telegram Bot API, with the data sent to a Telegram bot named Data_stealer associated with a private chat for the operator. The campaign also features SSH propagation to related hosts and uses a hardcoded mining pool and wallet, pool.hashvault[.]pro:80 and a wallet ID, to drive the mining operation.

Initial access and subsequent activity are detailed with commands and code snippets, including a base64-encoded curl command that downloads and executes a script from Codeberg, and the campaign’s public indicators of compromise include Codeberg-hosted URLs and the XMRig-related files mi[.]sh and xm64.tar[.]gz.

According to the researchers, the actors aim to pivot to cloud resources and to maintain persistence while evading detection, underscoring the need to secure exposed Jupyter environments and review firewall and security group configurations.