Skip to content

Back to the catalog

Untangling a Linux Incident With an OpenAI Twist
huntress.comwriteup

Untangling a Linux Incident With an OpenAI Twist

Huntress SOC analysts detail a Linux incident where a user, unaware their endpoint was compromised by a Monero cryptominer (mining to 62.60.246.210:443 via a binary masquerading as systemd-logind) and multiple threat actors, used OpenAI's Codex coding agent to troubleshoot loud fans and perform ad-hoc security audits. Codex's generated one-liners (curl, redirected output, chained pipes) closely resembled attacker living-off-the-land tradecraft, triggering EDR detections and forcing analysts to sift Codex session/chat logs to distinguish legitimate remediation from actual malicious activity by at least two threat actors performing cryptomining and credential theft. Part one of a two-part series on how AI-agent usage on a compromised host complicates SOC triage.

TL;DR A user's OpenAI Codex troubleshooting session on a cryptominer-infected Linux host generated commands nearly indistinguishable from attacker tradecraft, complicating Huntress SOC's incident triage.
Open original ↗

Technologies named here

Techniques named here

  • Living-off-the-land techniques
  • Log clearing on completion of attack
  • Cryptomining via background miner process
  • Command formatting resembling attacker tradecraft
  • Credential theft and data exfiltration
  • Persistence mechanisms
  • Reconnaissance of local services

Threat actors named here

  • Unnamed cryptominer operators
  • Monero cryptominer

Related in Blue Team & Detection