Koske AI generated malware hides in panda images to mine cryptocurrency

Threat actor: Unknown – opportunistic attackers exploiting misconfigured JupyterLab servers
Threat type: AI‑assisted Linux malware for cryptomining
Exploited weakness: Unauthenticated and misconfigured JupyterLab server exposure
Malware used: Koske (rootkit and shell script), with associated miners such as ccminer
Last observed: July 26 2025
Threat score: 🔴 High (8 / 10) – due to novel AI‑generated code, stealthy persistence and potential to infect any misconfigured server.

Overview

Koske is a sophisticated Linux malware campaign uncovered by Aqua Security’s Nautilus research team. Attackers exploit misconfigured JupyterLab instances to download two panda‑picture files from short URLs. These images are polyglot JPEGs – legitimate pictures with appended malicious code. When executed on a compromised server, the images unpack a shell script and a compiled C rootkit directly in memory. The shell script edits system configurations (such as .bashrc, .bash_logout and /etc/rc.local) and installs a custom shellkoske.service to ensure persistence. The rootkit hijacks the readdir() system call via the LD_PRELOAD mechanism, hiding files and processes named koske, hideproc and related strings. Once established, the malware downloads and executes cryptomining software, selecting from up to 18 different cryptocurrencies based on the host’s hardware. Koske’s code exhibits adaptive behaviour such as proxy‑checking and DNS resetting, indicating AI or automation assistance.

Key details

• Targeted systems and sectors – Servers running JupyterLab or similar web‑based development environments across all industries. The campaign is opportunistic rather than sector‑specific, affecting any misconfigured system exposed to the internet.
• Initial delivery mechanism – Attackers exploit misconfigured JupyterLab servers and download two pandas from shortened URLs (hosted on short[.]gy and tiny[.]cc) and free image hosting services. These polyglot JPEGs contain appended shell script and C code.
• Persistence and execution – The malware modifies .bashrc, .bash_logout and /etc/rc.local, registers a custom shellkoske.service, and creates cron jobs to execute every 30 minutes and at boot. It compiles the downloaded C code into a rootkit in memory and loads it using LD_PRELOAD, hijacking the readdir() call to hide evidence.
• Evasion capabilities – Koske uses a user‑mode rootkit to hide files and processes, stores temporary data in /dev/shm, and rewrites /etc/resolv.conf to lock Cloudflare/Google DNS via chattr +i, preventing detection or blocking. The polyglot images bypass traditional antivirus because the malicious payload lies at the end of a legitimate image.
• Network communication – The shell script resets proxy variables, flushes iptables rules and performs connectivity checks using curl, wget and raw TCP. It attempts to brute‑force working SOCKS5 and HTTP proxies from GitHub lists to reach its C2 and mining infrastructure.
• Final objective – Deploy cryptominers for at least 18 different cryptocurrencies, adjusting selection based on CPU/GPU availability. The downloaded miner is hosted on a GitHub account named vozstanica.
• Attribution – No direct attribution. The use of Serbian IP infrastructure, free image‑hosting services and a Slovak‑named GitHub account suggests a possible Eastern European actor, but AI‑generated code obscures linguistic fingerprints.

Attack vectors

Known indicators of compromise (IoCs)

IP address

• 178[.]220[.]112[.]53 – Attackers’ Serbian IP used for initial exploitation.

URLs hosting malicious images

• hxxps://iili[.]io/FhFK3Eg.jpg
• hxxps://k0ske[.]short[.]gy/panda_v14
• hxxp://tiny[.]cc/panda-v14
• hxxps://i[.]imgs[.]ovh/2025/07/17/DmvmA.jpeg
• hxxps://i[.]imgs[.]ovh/2025/07/17/DGlLc.jpeg

Malicious files and hashes

Other indicators

• Malicious GitHub account: vozstanica – hosts compiled cryptominers.
• Service names / files: .bashrc.koske, shellkoske.service, /etc/rc.local modifications and cron jobs at 30‑minute intervals.
• Hidden strings: Files or processes named koske, hideproc, or hideproc.so may indicate rootkit presence.

Mitigation and prevention

• Lock down exposed JupyterLab and development services – Restrict access to JupyterLab via authentication, VPN or IP allow‑lists. Regularly update to fix vulnerabilities such as CVE‑2025‑30370, and disable unauthenticated git extensions.
• Monitor system configuration files – Regularly audit .bashrc, .bash_logout, /etc/rc.local and systemd service definitions for unauthorised modifications. Look for unusual entries like .bashrc.koske or shellkoske.service.
• Inspect LD_PRELOAD settings – Check /etc/ld.so.preload and environment variables for unknown shared libraries. Investigate any references to hideproc.so or similar names.
• Block known IoCs – Add the malicious IP (178[.]220[.]112[.]53) and domains (tiny[.]cc, short[.]gy, i[.]imgs[.]ovh) to firewall and DNS blocklists. Use URL filtering to prevent downloads of polyglot images listed above.
• Deploy endpoint detection and response (EDR) – Use EDR tools capable of detecting user‑mode rootkits and unusual process hiding behaviours. Monitor for modifications to readdir() and unusual use of LD_PRELOAD.
• Network segmentation and proxy enforcement – Block unnecessary outbound connections from servers and enforce the use of monitored proxies. Regularly audit iptables rules and DNS configurations to detect unauthorised changes.
• Educate administrators – Train DevOps and data‑science teams on the risks of exposing development tools like JupyterLab to the internet. Encourage strong authentication, key‑based SSH, and least‑privilege principles.

Risk assessment

Koske represents a notable shift in the malware landscape due to its AI‑assisted development and multiple evasion techniques. Its opportunistic targeting of misconfigured JupyterLab servers means any organisation deploying these tools without proper security controls could become a victim. The use of polyglot image files, in‑memory payload execution and a user‑mode rootkit severely complicate detection. By automatically switching between 18 cryptocurrencies and employing adaptive proxy logic, Koske maximises profitability while remaining persistent. Given these factors, Koske’s threat level is high. However, its dependence on misconfiguration exploitation limits the scope; organisations that follow secure deployment practices can significantly reduce risk.

Conclusion

The Koske malware campaign demonstrates how adversaries are blending AI‑generated code with creative delivery techniques to build persistent cryptomining bots. By exploiting unauthenticated JupyterLab instances, attackers deliver polyglot panda images that unpack a stealthy rootkit and shell scripts directly in memory. The malware then hijacks system configuration files and systemd services to survive reboots, hides its processes via LD_PRELOAD hooks, manipulates DNS and proxy settings, and mines numerous cryptocurrencies using adaptive logic. Defenders must proactively lock down development tools exposed to the internet, monitor for the specific IoCs and system modifications listed above, and deploy detection solutions capable of identifying rootkit behaviour. The emergence of AI‑assisted malware like Koske underscores the need for behavioural detection and timely patching to stay ahead in the evolving cyber threat landscape.

Sources

• Dark Reading - AI-Generated Linux Miner 'Koske' Beats Human Malware
• Security Affairs - Koske, a new AI-Generated Linux malware appears in the threat landscape
• Aqua - AI-Generated Malware in Panda Image Hides Persistent Linux Threat
• The Hacker News - Soco404 and Koske Malware Target Cloud Services with Cross-Platform Cryptomining Attacks