Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Alibaba Cloud Security Team analyzed the script and the shared library and confirmed that the 8220 Mining Group now uses ProcessHider in the attack toolkit to hide its mining programs.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A user-space rootkit used by the 8220 Mining Group to conceal cryptocurrency-mining processes and prolong their operation on compromised hosts. It uses LD_PRELOAD to load a malicious shared library and hijack readdir, preventing dynamically linked process-monitoring commands such as ps and top from displaying selected processes. The described deployment uses /usr/local/lib/libkk.so and /etc/ld.so.preload to hide the process keyword kworkerds. Statically compiled utilities and network-traffic monitoring can reveal activity concealed from normal host commands.
Process-hiding rootkits downloaded as shared objects by dca to conceal shell processes and the cryptominer. Their deployment involves changes to dynamic-linker preload configuration. The narrative and IOC table reverse the filenames’ MD5 assignments, so the filename-to-hash mapping is inconsistent.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.