MYRA RAT Cron Persistence via .cache-update.sh Every 13 Minutes

Ethan Andrews@eandrews

•updated Jun 22, 2026•0•0•2

Detects MYRA Linux RAT establishing cron-based persistence by scheduling /usr/local/lib/.cache-update.sh to execute every 13 minutes with a fileless fallback chain using memfd_loader and agent_launcher. Indicative of the apintergrationpost npm supply chain attack by threat actor kimijohn01.