XMRig miner hidden as .trace in go2rtc directories via shell

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•0•0•2

Detects behavioral indicators of shell-driven cryptocurrency miner staging where a hidden .trace file or binary is created, executed, or referenced via command-line arguments within go2rtc or shared memory directories (/config/, /opt/go2rtc/, /etc/go2rtc/, /.config/go2rtc/, /dev/shm/), alongside indicators of mining pools or software such as XMRig.