8220 Gang

8220 Gang, also known as Water Sigbin and 8220, is a financially motivated, China-linked intrusion set focused primarily on opportunistic cryptojacking and related monetization activity. The group has been active since at least 2017 and is known for targeting exposed, vulnerable internet-facing infrastructure across both Windows and Linux environments, with a strong emphasis on cloud and web application servers. Reported victim sectors and geographies are broad, reflecting largely indiscriminate target selection rather than tightly scoped espionage objectives. The actor is best known for exploiting public-facing application vulnerabilities to gain initial access and execute remote commands. Recurrently abused products and flaws include Oracle WebLogic Server, Atlassian Confluence, Apache Log4j/Log4Shell, VMware Horizon, Hadoop YARN, Drupal, Apache Struts2, and JBoss-related services. Observed exploitation includes multiple WebLogic vulnerabilities such as CVE-2017-3506, CVE-2017-10271, CVE-2019-2725, CVE-2020-14882, CVE-2020-14883, and CVE-2023-21839, as well as CVE-2021-44228, CVE-2021-26084, and CVE-2022-26134. The group has repeatedly adapted older but still widely exposed vulnerabilities for mass exploitation. 8220 Gang commonly deploys cryptocurrency miners, especially XMRig-derived payloads and the PwnRig miner, and has also delivered additional malware including Tsunami, AgentTesla, rhajk, nasqa, ScrubCrypt, Hadooken, and K4Spreader. Tsunami provides IRC-based botnet and DDoS capability, while K4Spreader and Hadooken function as Linux-focused loaders and spreaders that establish persistence, disable defenses, remove competing malware, and install miners and backdoors. K4Spreader in particular has been observed using persistence through shell profile modification, cron jobs, init scripts, and systemd services, alongside firewall weakening, preload clearing, and host cleanup to retain control and maximize mining profitability. Tradecraft is centered on scalable exploitation and resilient payload delivery rather than stealthy long-term espionage. Across campaigns, the actor has used PowerShell, shell scripts, Python, Java-based exploit chains, custom downloaders, and staged loaders. Defensive evasion has included obfuscated scripts, layered base64 encoding, compressed and encrypted payloads, modified packers, AMSI bypasses, environment-variable-based batch obfuscation, reflective .NET loading, process injection, process hollowing, scheduled-task persistence, and abuse of legitimate processes for execution. On Linux and in containerized environments, the group has been observed disabling cloud security tooling, altering SELinux-related settings, manipulating cron, deleting logs, brute-forcing SSH for lateral movement, and killing rival miners or other malware. The actor has shown particular interest in cloud-hosted and containerized infrastructure, including Oracle Cloud and misconfigured Docker environments, where compromised compute resources can be monetized through illicit mining. Campaigns are frequently opportunistic and internet-scale, with little evidence of victim-specific reconnaissance before exploitation. The group has targeted both Linux and Windows web servers and has been observed adapting delivery methods to the operating system, using shell-based tooling on Linux and PowerShell-heavy chains on Windows. Attribution to 8220 Gang is supported by recurring overlaps in tooling, infrastructure patterns, payload families, infection routines, and monetization artifacts across campaigns. Some reporting also uses wallet reuse as a supporting signal, though that alone is not definitive. Overall, 8220 Gang is best characterized as a persistent, evolving cryptomining threat actor that continuously refreshes its loaders, spreaders, and evasion methods while exploiting exposed enterprise and cloud services at scale.