Loading threat actor…
8220 Mining Group is a financially motivated cybercriminal group operating from China and active since at least 2017. It compromises vulnerable servers to deploy cryptocurrency miners, consuming victims’ computing resources to generate Monero. Its name derives from its historical use of port 8220 to distribute malware. Its campaigns have exploited Apache Struts2, Drupal, Hadoop YARN, Redis, Oracle WebLogic, CouchDB, and JBoss, including vulnerabilities tracked as CVE-2017-10271, CVE-2018-7600, and CVE-2017-12149. The group distributes ELF miners and mining configurations through Bash downloaders, Git repositories, image-sharing services, and malicious Docker images. Delivery techniques include malicious scripts masquerading as JPEG images and encoded scripts retrieved from public hosting services. Its whatMiner toolkit scans for and exploits Redis and Oracle WebLogic servers. Scheduled cron jobs provide persistence and periodically retrieve and execute malicious scripts. 8220 Mining Group uses the ProcessHider rootkit to conceal mining processes on Linux systems. The rootkit abuses dynamic-library preloading and hooks the readdir function so that standard process-monitoring utilities omit selected processes, reducing visibility into resource-intensive mining activity. Although its tooling and delivery techniques overlap with those of Rocke and Tor2Mine, these are distinct actors rather than established subgroups of 8220 Mining Group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
4 CVEs this actor has used in observed campaigns. 4 of them exploited in the wild.
The mining group exploits the WebLogic XMLDecoder deserialization vulnerability (CVE-2017-10271), Drupal RCE (CVE-2018-7600), JBoss deserialization command execution vulnerability (CVE-2017-12149), and other vulnerabilities to attack hosts and deploy mining programs to make illegal profits.
The mining group exploits the WebLogic XMLDecoder deserialization vulnerability (CVE-2017-10271), Drupal RCE (CVE-2018-7600), JBoss deserialization command execution vulnerability (CVE-2017-12149), and other vulnerabilities to attack hosts and deploy mining programs to make illegal profits.
Interestingly, the cryptocurrency wallet used by the threat actors is the same one used in campaigns that exploited vulnerabilities such as CVE-2019-3396, a Confluence vulnerability, and CVE-2017-5638, an Apache Struts vulnerability. According to a report by Tencent Security, the 8220 mining group, a criminal gang based in China, is behind the campaign that exploited CVE-2017-5638.
The mining group exploits the WebLogic XMLDecoder deserialization vulnerability (CVE-2017-10271), Drupal RCE (CVE-2018-7600), JBoss deserialization command execution vulnerability (CVE-2017-12149), and other vulnerabilities to attack hosts and deploy mining programs to make illegal profits.
7 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A criminal group operating in China that exploits server vulnerabilities to deploy cryptocurrency miners for illicit profit. The reported activity adds the ProcessHider rootkit to conceal mining processes, prolong infections, and evade routine host inspection.
Active since 2017, this group compromises vulnerable servers to mine Monero. Infrastructure and wallet analysis linked it to campaigns exploiting Apache Struts2, Drupal, Hadoop YARN, Redis, Oracle WebLogic and CouchDB. It appears to have developed the whatMiner repository and also conducted a prolonged campaign using malicious Docker images. Public reporting attributed nearly $200,000 worth of Monero earnings to its campaigns.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.