Loading story…
A surge in coordinated cryptojacking attacks has targeted PHP and PHP-based frameworks, with threat actors exploiting multiple remote code execution (RCE) vulnerabilities such as those in ThinkPHP, PHP CGI, and PHPUnit. Telemetry from August through November 2025 shows a significant increase in exploitation attempts, with attackers leveraging both recent and older vulnerabilities—including CVE-2024-4577 and CVE-2019-9082—to deploy cryptominers at scale. The campaigns are characterized by shared infrastructure and tooling, indicating a high degree of coordination, and are primarily driven by the profitability of cryptocurrency mining amid rising Bitcoin prices.
Attackers are utilizing a mix of compromised virtual machines, misconfigured services, and rented cloud infrastructure from major providers like Cloudflare, DigitalOcean, Google, and Contabo. The activity is global, with significant participation from German, Taiwanese, Chinese, and North American hosting platforms. The economic incentive is heightened by the recent surge in cryptocurrency values, making large-scale cryptomining operations increasingly attractive to cybercriminals. Organizations running PHP-based applications are at heightened risk and should prioritize patching known RCE vulnerabilities to mitigate exposure to these ongoing campaigns.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
A follow-up report described the activity as a coordinated cryptojacking blitz abusing ThinkPHP and PHP RCE flaws to maximize mining revenue, reinforcing the scope and intent of the campaign.
GreyNoise publicly reported on the ongoing PHP cryptomining activity, describing the campaign as active during October and November 2025 and highlighting exploitation observed in the wild.
In October 2025, attackers began a coordinated cryptomining campaign exploiting remote code execution vulnerabilities in PHP applications, including ThinkPHP, to deploy mining payloads on exposed servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity researchers have reported a significant surge in automated attacks against PHP servers, IoT devices, and cloud gateways, primarily orchestrated by botnets such as Mirai, Gafgyt, and Mozi. These campaigns exploit a range of known vulnerabilities—including `CVE-2017-9841` (PHPUnit), `CVE-2021-3129` (Laravel), and `CVE-2022-47945` (ThinkPHP)—as well as cloud misconfigurations and insecure deployments. The widespread use of PHP-based content management systems like WordPress and Craft CMS, combined with common misconfigurations and outdated plugins, has expanded the attack surface, making these environments especially attractive to threat actors seeking remote code execution or data theft opportunities. Attackers are also leveraging insecure debugging tools, such as leaving Xdebug active in production, and are actively searching for exposed credentials, API keys, and AWS secrets on internet-facing servers. IoT devices remain a persistent weak link, with vulnerabilities like `CVE-2022-22947` (Spring Cloud Gateway) and `CVE-2024-3721` (TBK DVR-4104/4216) being targeted to conscript devices into botnets. The Qualys Threat Research Unit emphasizes that the combination of known software flaws and misconfigurations continues to drive the growth of large-scale botnet activity, posing ongoing risks to enterprises and cloud environments.
Jun 29, 2026
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Attackers used compromised web hosts at U.S. education organizations to run a cryptojacking operation, sending backdoor commands that downloaded and executed a UPX-packed `cpuminer` payload. Palo Alto Networks Unit 42 said it observed three incidents in February and March 2021 with the same attack pattern, similar payloads, and consistent targeting of the education sector, indicating likely activity by a single operator. The malicious HTTP requests looked like webshell or backdoor activity rather than simple exploitation, featuring direct operating-system command execution, disguised or unusual user-agent strings, and in later cases a password parameter. In two incidents, the attacker also fetched a mini shell disguised as `wp-load.php`, suggesting the compromised directory was exposed to the internet; one mining attempt failed because the algorithm name was misspelled as `cpupoer` instead of `cpupower`, while the miner was configured to use wallet-specific cryptocurrency addresses.
Aug 14, 2026