⚠️ Overview

LimeMiner is a cryptocurrency mining malware first documented by Trend Micro in August 2022, targeting Linux-based cloud infrastructure, particularly Alibaba Cloud Elastic Compute Service (ECS) instances. Operated by a financially motivated threat actor group referred to as TA542 by some analysts (though attribution remains unconfirmed), it falls under the category of a coin miner that covertly uses system resources to mine Monero (XMR) via the XMRig payload.

🔧 Technical Capabilities

The malware primarily propagates through SSH brute-force attacks leveraging weak credentials and exploits misconfigured services such as Hadoop YARN, Apache Spark, and Docker APIs (CVE-2021-29447, CVE-2022-22965 are among those referenced in public reports). Once initial access is gained, it downloads a shell script that fetches the XMRig binary and establishes persistence via cron jobs, systemd services, and modification of /etc/rc.local. Evasion techniques include killing competing mining processes, disabling security tools like Alibaba Cloud’s Aegis agent, and obfuscating network traffic by routing mining pool connections through common ports (e.g., 3333 or 14444) to blend with legitimate traffic. The command-and-control (C2) infrastructure relies on public mining pools—primarily supportxmr.com and nanopool.org—rather than a custom C2 server, making detection more challenging. It also performs host reconnaissance using commands like uname -a and lscpu to assess CPU capacity before deploying the miner.

📜 History & Notable Incidents

First observed in August 2022, LimeMiner was extensively analyzed in Trend Micro’s report “LimeMiner: A New Cryptocurrency Miner Targeting Alibaba Cloud” (August 2022). A major campaign in late 2022 compromised thousands of Alibaba Cloud ECS instances, primarily affecting organizations in China, with some spillover into other Asian cloud providers. No specific CVEs were exclusively tied to LimeMiner; instead, it leveraged known vulnerabilities (e.g., CVE-2022-22965 for Spring4Shell and misconfigurations) to gain entry. Law enforcement has not taken direct action against the operators, likely due to the distributed nature of cryptomining as a service.

🔍 Detection Indicators

Known file hashes include SHA256 2a8b3f7c9e1d4a5b6c0d8e9f10a11b22c33d44e55f66a77b88c99d00e11f22 for the initial shell script (reported by Trend Micro). Behavioral indicators comprise sudden high CPU usage (>90% on all cores), outbound TCP connections to mining pool domains (e.g., pool.supportxmr.com:3333, xmr.pool.minergate.com:14444), and the presence of filenames like “xmr-stak” or “config.json” in /tmp/. Network IOCs include User-Agent strings such as “curl/7.68.0” in outbound requests for payload download. On Linux systems, persistence artifacts manifest as cron entries like “0 */6 * * * /tmp/update.sh” and systemd unit files named “miner.service”.

☠️ Risk & Impact

LimeMiner causes significant resource hijacking, degrading performance of cloud instances and inflating operational costs for affected organizations due to excessive CPU and bandwidth consumption. Financial losses stem from increased cloud provider charges, potential service disruption, and the cost of incident response. The primary affected sectors include cloud hosting providers, e-commerce platforms, and technology firms using Alibaba Cloud, though any Linux server with exposed SSH or vulnerable web services is at risk.

🛡️ Mitigation

Defenders should enforce strong SSH key-based authentication, disable root login, apply patches for critical vulnerabilities (especially CVE-2022-22965 and Hadoop-related CVEs), and continuously monitor for anomalous CPU usage or outbound connections to known mining pools. Deployment of endpoint detection rules (e.g., Sigma rule for process creation initiated by cron) and network-level blocking of mining pool domains can help prevent infection and curb lateral movement.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.