Loading malware…
K4Spreader is a Linux malware loader associated with the 8220 Gang, also known as Water Sigbin, and observed since February 2024. Implemented in Go with CGO components, it primarily deploys the Tsunami IRC-controlled backdoor and DDoS bot and the PwnRig Monero miner, an XMRig derivative. It can download and execute additional payloads, extract embedded executable payloads, and update itself. Some variants use modified UPX packing, including a version with two packing layers, while other observed samples are unobfuscated. Newer variants retrieve tasking as Base64-encoded, gzip-compressed JSON.
K4Spreader establishes persistence through shell-profile modifications, cron jobs, SysVinit scripts, and systemd services. It uses filesystem immutability attributes to hinder removal, disables host firewalls and cloud security tools, clears dynamic-linker preload configuration, and terminates competing cryptominers. Its deployment chains also use shell scripts to identify SSH targets and attempt lateral propagation through SSH brute force.
Distribution occurs through exploitation of vulnerable server applications, including Oracle WebLogic, JBoss, and Hadoop YARN. Observed WebLogic campaigns have exploited CVE-2017-10271, CVE-2020-14882, and CVE-2020-14883. Targeting is opportunistic and includes cloud-hosted Linux servers, with resource hijacking for cryptocurrency mining as a principal objective. K4Spreader shares infection routines, payloads, and infrastructure with Hadooken, but the two are distinct malware variants. Remote-control and DDoS functionality in these deployments is provided by Tsunami rather than established as an intrinsic K4Spreader capability.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.