Loading story…
Attackers compromised Alibaba Cloud OSS buckets and used them to host malware that deployed XMRig for Monero cryptojacking and attempted remote code execution against misconfigured Redis servers. The activity appears to have relied on leaked or stolen OSS credentials, including AccessKey IDs, AccessKey secrets, and authentication tokens, while weak bucket access policies and credentials exposed in public repositories may also have enabled access.
The malware was concealed inside legitimate-looking PNG files using a simple steganography method that appended shell script data to the image, helping it evade basic inspection. After victims downloaded the files, the attackers used standard Unix tools such as dd to extract and run the embedded script, then connected mining activity to xmr-asia1[.]nanopool[.]org to generate Monero.
See attribution, scope, and your downstream exposure.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro reported a campaign in which threat actors used compromised Alibaba Cloud OSS buckets to distribute PNG files with embedded malicious shell scripts, deploy XMRig for Monero mining, and target misconfigured Redis instances. The report said the attackers likely relied on leaked, stolen, or exposed OSS credentials and insecure bucket policies, and published related malware hashes and technical details.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors abused exposed Docker servers by creating a malicious Alpine Linux container that launched a multi-stage infection chain, ultimately installing both a cryptocurrency miner and an IRC-based DDoS bot. The attack used a Bash script named `XMI` and a Python script named `d.py` to download payloads, establish persistence, and spread further, with the miner identified as **Coinminer.Linux.MALXMR.UWELD** and the bot as a Kaiten/Tsunami variant detected as **Backdoor.Linux.KAITEN.AMV**. The malware relied on Base64 obfuscation, cron jobs, and a service placed in `/etc/init.d` for persistence, and it attempted lateral movement by harvesting targets from `/.ssh/known_hosts`; researchers also found commented-out SSH brute-force propagation code. Trend Micro said the miner wallet overlapped with earlier campaigns exploiting `CVE-2019-3396` and `CVE-2017-5638`, previously associated in public reporting with the **8220** mining group, while the DDoS component communicated with command-and-control infrastructure including `c4k[.]xpl[.]pwndns[.]pw`, `104[.]244[.]75[.]25`, and `107[.]189[.]11[.]170`.
Aug 14, 2026
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
A Linux-focused botnet used the Tor network and a large proxy infrastructure to conceal command-and-control traffic, deliver payloads, and exfiltrate victim data while deploying the **XMRig** Monero miner on compromised systems. The malware arrived as a multilayer-encoded shell script, supported multiple Linux architectures, and fetched legitimate utilities such as `ss`, `ps`, and `curl` when they were not already present, indicating an effort to operate flexibly across diverse server environments. The campaign also abused infrastructure-as-code and cloud management tools including **Ansible**, **Chef**, and **SaltStack** to expand laterally and scale infections. Once active, the malware removed rival cryptominers and disabled or uninstalled cloud monitoring and security agents tied to **Tencent Cloud**, **Alibaba Cloud**, and **Aegis/YunJing**, while researchers found evidence suggesting some Tor proxy and mining-pool servers used in the operation may themselves have been compromised hosts with exposed and vulnerable services.
Aug 14, 2026