8220 Gang
8220 Gang, also referred to as Water Sigbin, is a financially motivated, opportunistic intrusion set widely described in the provided reporting as China-based or of Chinese origin. The group has been active since at least 2017/2018 and is primarily associated with mass deployment of cryptocurrency-mining malware and cryptojacking on vulnerable internet-facing systems, especially cloud and web server environments. Reported targets include Windows and Linux web servers, VMware Horizon, Oracle WebLogic, Atlassian Confluence, and vulnerable cloud hosting environments; sectors mentioned include healthcare, telecommunications, financial services, and Korean energy-related companies. Across the cited reporting, 8220 Gang is repeatedly linked to exploitation of public-facing vulnerabilities including CVE-2017-3506, CVE-2017-10271, CVE-2019-2725, CVE-2020-14883, CVE-2021-26084, CVE-2021-44228 (Log4Shell), CVE-2022-26134, and CVE-2023-21839. Observed post-exploitation activity includes PowerShell and shell-script downloaders, HTTP/XML-based command execution against WebLogic, use of multiple download methods depending on OS, AMSI bypass, fileless execution, reflective DLL injection, process hollowing, scheduled tasks, cron jobs, systemd services, registry-based configuration storage, disabling or excluding Windows Defender, disabling cloud security tooling, modifying SELinux and /etc/ld.so.preload, deleting logs, and lateral movement via SSH brute force. The group is associated with deployment of XMRig and other Monero miners, as well as malware and tooling including ScrubCrypt, PureCrypter, Hadooken, K4Spreader, Tsunami, AgentTesla, rhajk, and nasqa. Reporting also describes use of Tsunami for IRC-based command and control and botnet/DDoS capability. On VMware Horizon, Oracle WebLogic, and Confluence compromises, the group was observed using staged loaders and injectors to ultimately run XMRig in legitimate processes. In cloud/container-focused campaigns, 8220 Gang used malicious scripts to establish persistence, kill competing miners, disable cloud protections, and spread internally. Known aliases in the provided content are 8220 Gang and Water Sigbin.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Energy
Where they target
Geographies tied to known operations.
- 🇰🇷 South Korea
Tradecraft
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
Associated vulnerabilities
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
Ahnlab Security Emergency response Center (ASEC) has recently confirmed that the 8220 Gang attack group is using the Log4Shell vulnerability to install CoinMiner in VMware Horizon servers. Log4Shell (CVE-2021-44228) is both a remote code execution vulnerability and the Java-based logging utility Log4j vulnerability...
In November 2017, it used the Weblogic deserialization vulnerability (CVE- 2017-10271) invading a server and implanting a mining Trojan.
"...the 8220 Gang has been found to cunningly use HTTP requests for malicious purposes, most notably exploiting the Oracle WebLogic vulnerability CVE-2017-3506. By executing arbitrary commands via a specifically crafted XML document embedded in an HTTP request..."
Currently, there are few samples and the following vulnerabilities are exploited. CVE_2020_14882
The group targets not only global systems but also Korean ones. ASEC has introduced a case where the attack group abused the Atlassian Confluence server vulnerability CVE-2022-26134 to attack Korean systems and install CoinMiner.
Observables
27 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Opportunistic cloud-focused intrusion set exploiting Oracle WebLogic vulnerabilities to compromise Windows and Linux cloud servers, disable security tooling, spread laterally via SSH brute force, establish persistence (cron/systemd), and deploy Monero cryptominers; also deploys the Tsunami IRC-controlled backdoor for botnet/DDoS capability.
Water Sigbin is known for exploiting Oracle WebLogic vulnerabilities to deploy cryptocurrency miners, specifically using a sophisticated multi-stage, fileless malware delivery chain that leverages reflective DLL injection, process injection, and anti-debugging techniques. The group primarily deploys the PureCrypter loader and XMRig miner, focusing on evasion and persistence.
The 8220 gang is a financially motivated threat actor known for mass deployment of cryptojacking malware targeting both Windows and Linux web servers. They exploit well-known vulnerabilities in public-facing applications to propagate malware, primarily for illicit cryptocurrency mining. Their operations are opportunistic, targeting a range of industries and geographies, and they frequently reuse infrastructure and TTPs.
8220 Gang is known for using application layer protocols for C2 and exploiting vulnerabilities such as CVE-2017-3506 for initial access.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.