lambsys Cryptominer Security Tool Disablement and Firewall Flush on Linux

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•6

Detects malicious attempts to impair system defenses on Linux hosts, specifically targeting AppArmor, SELinux, firewalls (UFW/iptables), and security monitoring agents (Crowdstrike/osquery/Aliyun) by the 'lambsys' cryptominer campaign. This behavior aligns with adversary attempts to evade detection and maintain persistence or resource consumption.