8220 Gang

8220 Gang, also known as Water Sigbin, is a financially motivated, China-linked intrusion set focused primarily on opportunistic cryptojacking and related monetization activity. Active since at least 2017, the group is known for mass exploitation of internet-exposed applications and cloud workloads, especially Oracle WebLogic, Atlassian Confluence, Apache Log4j/Log4Shell, VMware Horizon, Hadoop YARN, Drupal, and Apache Struts2. Its operations target both Windows and Linux systems, with a strong emphasis on vulnerable web servers and cloud-hosted environments. The actor’s core objective is hijacking victim compute resources for cryptocurrency mining, most commonly through XMRig-derived miners and the PwnRig miner. It has also deployed additional malware families including Tsunami, Hadooken, K4Spreader, AgentTesla, rhajk, nasqa, and ScrubCrypt. Tsunami provides IRC-based botnet functionality and DDoS capability, while K4Spreader and Hadooken act as Linux-focused installers and spreaders that establish persistence, disable defenses, remove competing malware, and deploy miners and botnet payloads. 8220 Gang commonly gains initial access by exploiting known remote code execution and authentication bypass vulnerabilities in public-facing services. Observed tradecraft includes PowerShell and shell-script downloaders, malicious XML payloads, Java-based exploitation chains, reflective .NET loading, in-memory execution, layered base64 and compression-based obfuscation, hexadecimal URL encoding, process hollowing, and process injection. On Windows, the group has used staged loaders and crypters to inject miners into legitimate processes, disable AMSI, add antivirus exclusions, and create scheduled tasks for persistence. On Linux, it has used cron jobs, init/systemd services, shell and Python scripts, SSH brute force, and modification of startup files to maintain access and spread laterally. The group also demonstrates defense evasion and post-exploitation behavior by disabling host firewalls and cloud security tooling, clearing preload-based hooks, deleting logs, killing rival miners, and removing competing persistence mechanisms. Campaigns against containerized and cloud environments have included targeting misconfigured Docker deployments and using brute-force tooling to expand access across internal networks. Targeting is broad and opportunistic rather than tightly scoped, but reported victims include cloud hosting environments, web infrastructure, healthcare, telecommunications, financial services, and energy-related organizations. Activity has been observed against targets in multiple countries, including South Korea, the United States, South Africa, Spain, Colombia, and Mexico. The actor is widely assessed as financially motivated, with cryptomining as its dominant objective, while some operations also incorporate botnet deployment and DDoS-enabling malware.