8220

8220 is a China-linked cryptomining threat group, also referred to as the 8220 gang and Water Sigbin. Reporting attributes to the group a Linux-focused malware deployment campaign using a custom installer dubbed k4spreader, first seen in February 2024, to install additional payloads including the Tsunami IRC-based DDoS botnet and the PwnRig Monero miner. The group’s tooling has been observed implementing persistence through .bash_profile modification with chattr immutability, init.d and systemd service creation, cron-based retrieval of follow-on payloads, self-update capability, C2-driven downloading, firewall and iptables disabling, clearing /etc/ld.so.preload, and removal of competing malware and suspicious cron entries/processes. Observed access and exploitation vectors associated with 8220 include Oracle WebLogic vulnerabilities CVE-2020-14883 and CVE-2020-14882, CVE-2017-3506 via crafted XML in HTTP requests, and additional RCE paths identified as JBoss_AS_3456_RCE and YARN_API_RCE. FortiGuard also reported a campaign attributed to 8220 exploiting CVE-2020-14883 commonly chained with CVE-2020-14882 to deploy stealer and cryptominer malware, including AgentTesla, rhajk, and nasqa. The group has been associated with HTTP-based delivery and application-layer protocol use, and infrastructure including domains and IPs used for C2, IRC, and mining operations. Known aliases directly mentioned in the content: Water Sigbin. No sub-groups are directly identified in the provided content.