Kernel Thread Impostor

An internet-exposed Linux node lit up with authentication noise this morning. Work the Linux authentication records and determine which single account was hammered with password attempts and ultimately let an outsider in.

The compromised account let someone in from outside. Pin down the external address that landed the successful login, so it can be blocked and hunted across the rest of the estate.

Within seconds of logging in, the intruder pulled down and unpacked a payload. Identify the hidden directory the malware unpacked itself into on the host.

A CPU-bound process started running from inside that hidden directory, wearing a name that makes it look like part of the kernel. Name the process the attacker used to disguise the miner.

Confirm the impact by following the miner's traffic out of the network. Identify the external mining destination the infected host beacons to.

Summarize the adversary's end goal for the incident report by mapping it to MITRE ATT&CK. Identify the technique that describes hijacking the host's resources to mine cryptocurrency.