Security researchers have spotted a new strain of malware being deployed online. Named RubyMiner, this malware is a cryptocurrency miner going after outdated web servers. The group uses a web server fingerprinting tool named p0f to scan and identify Linux and Windows servers running outdated software. Once they identify unpatched servers, attackers deploy well-known exploits to gain a foothold on vulnerable servers and infect them. The attacks are peculiar because attackers use very old exploits to detect and which would have alerted server owners.
Source: https://www.bleepingcomputer.com/news/security/linux-and-windows-servers-targeted-with-rubyminer-malware/