Codex Troubleshooting Complicated Huntress’ Investigation of a Linux Compromise
Summary
Huntress says a Linux host targeted by multiple threat actors had a Monero miner, credential theft and data exfiltration. The user’s Codex troubleshooting masked the miner and generated commands that complicated SOC triage.
Key points
- Huntress installed its agent mid-compromise, so analysts lacked historical EDR telemetry and could not determine the initial access vector.
- A miner had been running since boot, mining Monero to 62.60.246[.]210:443; its binary was /var/tmp/systemd-logind.
- Codex suggested CPU throttling that quieted the system but initially failed to diagnose or remove the miner.
- Codex-generated commands resembled attacker reconnaissance and triggered EDR signals, requiring analysts to separate legitimate activity from malicious behavior.
- The investigation indicated at least two sets of threat actors were involved in cryptomining, credential theft, data exfiltration and persistence.
- The user later used Codex to stop one miner instance, but attackers reportedly continued returning and exfiltrating credentials, keys, tokens and cloud metadata.
- Huntress says part two will provide more detail on the investigation after its agent was installed.
Article Details
- Attack Vectors
- The initial access vector could not be determined because Huntress was installed after the compromise had begun.
- The host was targeted by at least two sets of threat actors. Reported activity included cryptomining, credential theft, data exfiltration, and persistence; the article does not specify how access was gained.
- Defensive Notes
- Investigate live endpoint telemetry alongside historical artifacts; the article notes that installing EDR mid-compromise leaves a gap in visibility into earlier activity.
- Review AI-agent session and chat logs to distinguish legitimate user actions from potentially malicious activity.
- Do not treat suspicious-looking commands as malicious based on formatting alone; assess them in context.
- CPU throttling masked the miner’s symptoms without stopping it. The article also reports that the threat actor returned after some malicious processes were shut down.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 62[.]60[.]246[.]210 | Mining-pool IP address to which the previously installed Monero miner connected. |