New Golang worm turns Windows and Linux servers into monero miners | SC Media
The assault uses three files: a dropper script (bash or PowerShell), a Golang binary worm, and an XMRig Miner—all of which are hosted on the exact same command and command server.