Luno: A “Self-Healing” Linux Botnet That Mines Crypto and Launches DDoS Attacks

CRIL has identified an active in-the-wild Linux botnet campaign dubbed “Luno,” which merges cryptomining, remote command execution, and modular DDoS capabilities within a single resilient malware framework. According to CRIL, the Luno Botnet campaign is carried out with a dual motivation: Cryptomining and DDoS-as-Service, and LunoC2 shows long-term infrastructure ambitions with process masquerading, binary replacement, and a self-update system that sustains persistence and monetisation flexibility.

The malware is described as highly resilient, with anti-analysis measures, a self-healing loop, signal resistance for termination signals, and the ability to masquerade as legitimate processes. It uses setsid to daemonise execution and employs mkstemp polymorphism to generate unique filenames for self-updates, helping to hide forensic traces, while terminating unauthorized processes that try to use its sockets.

Luno silently deploys the XMRig miner by downloading it from main.botnet[.]world and saving it as /bin/ash_, targeting resource-constrained Linux distributions such as BusyBox, Alpine Linux, and OpenWrt.

The campaign also features a modular DDoS engine with dozens of attack types, including udp-flood, syn-flood, HTTP floods, WebSocket floods, RakNet floods, fake Minecraft logins, Roblox-specific floods, and Valorant QUIC floods, and the operators advertise and manage this via a Telegram channel created on 28 July 2025 by the handle “udpboss.”