{"id":24972,"date":"2019-02-05T15:02:47","date_gmt":"2019-02-05T15:02:47","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/29789\/Outlaw-Shellbot-Infects-Linux-Servers-To-Mine-For-Monero.html"},"modified":"2019-02-05T15:02:47","modified_gmt":"2019-02-05T15:02:47","slug":"outlaw-shellbot-infects-linux-servers-to-mine-for-monero","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/","title":{"rendered":"Outlaw Shellbot Infects Linux Servers To Mine For Monero"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/zdnet2.cbsistatic.com\/hub\/i\/r\/2019\/02\/04\/c08d3c35-5001-4dac-8a00-e0b9eccc3052\/thumbnail\/770x578\/669ce79b7cdd1f758fec6f6c17ff99ac\/screenshot-2019-02-04-at-11-43-34.png\" class=\"ff-og-image-inserted\"\/><\/div>\n<p>The Outlaw group is conducting an active campaign which is targeting Linux systems in cryptocurrency mining attacks.<\/p>\n<p>On Tuesday, the <a href=\"https:\/\/jask.com\/solutions\/special-ops\/\" target=\"_blank\" rel=\"noopener noreferrer\">JASK Special Ops<\/a> research team disclosed <a href=\"https:\/\/jask.com\/wp-content\/uploads\/2019\/02\/Shellbot-Campaign_v2.pdf\" target=\"_blank\" rel=\"noopener noreferrer\">additional details<\/a>\u00a0(.PDF) of the attack wave which appears to focus on seizing infrastructure resources to support illicit Monero mining activities.<\/p>\n<div class=\"relatedContent alignRight\">\n<h3 class=\"heading\"><span class=\"int\">More security news<\/span><\/h3>\n<\/div>\n<p>The campaign uses a refined version of Shellbot, <a href=\"https:\/\/www.symantec.com\/security-center\/writeup\/2005-060316-4212-99\" target=\"_blank\" rel=\"noopener noreferrer\">a Trojan<\/a> which carves a tunnel between an infected system and a command-and-control (C2) server operated by threat actors.\u00a0<\/p>\n<p>The backdoor is able to collect system and personal data, terminate or run tasks and processes, download additional payloads, open remote command line shells, send stolen information to a C2, and also receive additional malware payloads from controllers.<\/p>\n<p>The bot first emerged in November 2018. According <a href=\"https:\/\/blog.trendmicro.com\/trendlabs-security-intelligence\/perl-based-shellbot-looks-to-target-organizations-via-cc\/\" target=\"_blank\" rel=\"noopener noreferrer\">to Trend Micro<\/a>, the malware is the work of the Outlaw group, a rough translation derived from &#8220;haiduc,&#8221; a Romanian phrase which has been bequeathed to the main hacking tool the group uses. <em><br \/><\/em><\/p>\n<p>Shellbot is an IRC bot which is distributed through common command injection vulnerabilities which target not only vulnerable Linux servers, but also a variety of Internet of Things (IoT) devices.<\/p>\n<p>The cybersecurity researchers note that Shellbot has the capacity to affect Windows environments and Android devices, too, but such infections are uncommon.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_ZD_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p><strong>See also:\u00a0<\/strong><a href=\"https:\/\/www.zdnet.com\/pictures\/all-of-facebooks-privacy-and-data-snafus-in-recent-history\/\" target=\"_blank\">Facebook&#8217;s worst privacy scandals and data disasters<\/a><\/p>\n<p>In attacks recorded in November by Trend Micro, Outlaw was able to compromise a File Transfer Protocol (FTP) server of a Japanese art organization, alongside a Bangladeshi government website. Another attack recorded by JASK, which is most likely from the same threat group, managed to break into multiple Linux servers belonging to a single, unnamed company.<\/p>\n<p>Each of these systems received payloads post-infection including IRC C2 botware, cryptomining malware, and the haiduc SSH scan and network propagation toolkit. The cryptocurrency malware in question was a mining script, XMR-Stak, designed to utilize stolen server resources to mine for Monero (XMR).<\/p>\n<p>The pool used to generate cryptocurrency, however, is currently down and the only clues available shows that the pool was hosted on a game server.<\/p>\n<p>&#8220;This indicates that these campaign actors may have built their own mining pool infrastructure on this provider instead of using publicly available ones,&#8221; the researchers say.<\/p>\n<p><strong>TechRepublic:\u00a0<\/strong><a href=\"https:\/\/www.techrepublic.com\/article\/how-to-secure-nginx-with-lets-encrypt\/\" target=\"_blank\" rel=\"noopener noreferrer\">How to secure NGINX with Let&#8217;s Encrypt<\/a><\/p>\n<p>The threat actors target organizations through denial-of-service (DoS) and SSH brute-force techniques. If servers are compromised, their strength is added to the Outlaw botnet to carry on the campaign.<\/p>\n<p>According to JASK, the botnet is now being used to monetize compromised computing systems through distributed denial-of-service (DDoS) for hire services alongside illicit cryptomining.<\/p>\n<p>The toolkit belonging to Outlaw is now also making use of a Perl-based IRC bot which has been identified as a new version of Shellbot bolstered by Perl&#8217;s pack routine for the purposes of obfuscation.<\/p>\n<p><strong>CNET:\u00a0<\/strong><a href=\"https:\/\/www.cnet.com\/news\/the-huawei-controversy-everything-you-need-to-know\/\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>The Huawei controversy: Everything you need to know<\/strong><\/a><\/p>\n<p>&#8216;The C2 is still active and the botnet is growing,&#8221; the security researchers say. &#8220;The multistage payloads suggest reuse and repurpose of shellbot code used by operators in different regions of the world, including Brazil and Romania. JASK also has observed newly adapted payloads that craft specific mining tasks for different architectures and post exploitation worm-like behavior.&#8221;<\/p>\n<h3>Previous and related coverage<\/h3>\n<p>READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/29789\/Outlaw-Shellbot-Infects-Linux-Servers-To-Mine-For-Monero.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":24973,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[5747],"class_list":["post-24972","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity-blogs","tag-headlinehackermalwarelinuxbotnetfraudcryptography"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Outlaw Shellbot Infects Linux Servers To Mine For Monero 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Outlaw Shellbot Infects Linux Servers To Mine For Monero 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2019-02-05T15:02:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/02\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png\" \/>\n\t<meta property=\"og:image:width\" content=\"770\" \/>\n\t<meta property=\"og:image:height\" content=\"578\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Outlaw Shellbot Infects Linux Servers To Mine For Monero\",\"datePublished\":\"2019-02-05T15:02:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/\"},\"wordCount\":547,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/02\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png\",\"keywords\":[\"headline,hacker,malware,linux,botnet,fraud,cryptography\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/\",\"name\":\"Outlaw Shellbot Infects Linux Servers To Mine For Monero 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/02\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png\",\"datePublished\":\"2019-02-05T15:02:47+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/02\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/02\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png\",\"width\":770,\"height\":578},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,malware,linux,botnet,fraud,cryptography\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackermalwarelinuxbotnetfraudcryptography\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Outlaw Shellbot Infects Linux Servers To Mine For Monero\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Outlaw Shellbot Infects Linux Servers To Mine For Monero 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/","og_locale":"en_US","og_type":"article","og_title":"Outlaw Shellbot Infects Linux Servers To Mine For Monero 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2019-02-05T15:02:47+00:00","og_image":[{"width":770,"height":578,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/02\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png","type":"image\/png"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Outlaw Shellbot Infects Linux Servers To Mine For Monero","datePublished":"2019-02-05T15:02:47+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/"},"wordCount":547,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/02\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png","keywords":["headline,hacker,malware,linux,botnet,fraud,cryptography"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/","url":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/","name":"Outlaw Shellbot Infects Linux Servers To Mine For Monero 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/02\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png","datePublished":"2019-02-05T15:02:47+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/02\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/02\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero.png","width":770,"height":578},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/outlaw-shellbot-infects-linux-servers-to-mine-for-monero\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,malware,linux,botnet,fraud,cryptography","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackermalwarelinuxbotnetfraudcryptography\/"},{"@type":"ListItem","position":3,"name":"Outlaw Shellbot Infects Linux Servers To Mine For Monero"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/24972","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=24972"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/24972\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/24973"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=24972"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=24972"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=24972"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}