Loading story…
Cisco Talos documented a long-running cryptomining campaign by an actor it tracks as Panda, which used public remote-code-execution flaws to compromise internet-facing servers and deploy Monero miners. The activity spanned 2018 through August 2019 and abused multiple vulnerabilities, including Oracle WebLogic CVE-2019-2725 and CVE-2017-10271, Apache Struts 2 CVE-2017-5638, and ThinkPHP CNVD-2018-24942. Oracle separately issued a security alert for CVE-2019-2725, one of the flaws later incorporated into Panda's intrusion chain.
Talos said the actor frequently rotated infrastructure across domains including idc3389[.]top, bulehero[.]in, hognoob[.]se, and fxxxxxxk[.]me, while keeping consistent tactics such as PowerShell- and Certutil-based payload delivery, SMB scanning, brute forcing, and lateral movement with Shadow Brokers-linked exploits and Mimikatz. In some cases Panda also deployed Gh0st RAT and used Chinese-language IP geolocation services during victim profiling. Organizations in banking, healthcare, transportation, telecommunications, and IT services were affected, and Talos estimated the campaign generated about 1,215 XMR—roughly $100,000 at the time—showing that opportunistic cryptomining remained an active enterprise threat.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
Talos published research describing Panda as a long-running and adaptable cryptomining threat tracked from 2018 through August 2019. The report said the actor exploited multiple public vulnerabilities, affected organizations across several sectors, and had earned roughly 1,215 XMR.
In March 2019, Panda moved campaign infrastructure to subdomains of hognoob[.]se while keeping similar tactics, techniques, and procedures. Talos observed payload delivery from fid[.]hognoob[.]se and retrieval of miner components and configuration data from related hosts.
In January 2019, Talos observed Panda exploiting ThinkPHP vulnerability CNVD-2018-24942 to download download.exe from a46[.]bulehero[.]in and upload the hydra.php web shell. The web shell enabled arbitrary system command execution via HTTP parameters.
By October 2018, Talos noted that the configuration file hosted on list[.]idc3389[.]top had reportedly been downloaded more than 300,000 times. This indicated substantial scale for the Panda mining operation.
Talos reported that the Panda threat actor began conducting widespread illicit cryptocurrency mining campaigns in July 2018. The activity was linked to the earlier MassMiner campaign through shared wallet usage, infrastructure, and post-exploitation PowerShell commands.
Oracle published a security alert for CVE-2019-2725. The reference establishes the vendor disclosure of the WebLogic vulnerability later cited by Talos as one of Panda's exploited flaws.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 84 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited multiple publicly disclosed **pre-authentication vulnerabilities** in internet-exposed enterprise products to install **Monero-mining malware** on both Windows and Linux systems. Observed targets included **Apache HTTP Server**, **Atlassian Confluence**, **F5 BIG-IP**, **VMware vCenter**, and **Oracle WebLogic Server**, with exploitation attempts seen in the wild through honeypots. The operation abused trusted cloud platforms **GitHub** and **Netlify** to host delivery scripts and miner payloads, helping the malware blend into normal HTTPS traffic before the hosted content was removed. On Windows, the malware used batch scripts to profile infected hosts, download **XMRig** and supporting components, establish persistence, and run the miner as a background service. On Linux, shell scripts killed high-CPU processes, removed competing miners, fetched multiple binaries and configuration files, and launched mining with `nohup`. The campaign highlighted how public proof-of-concept exploits, unpatched exposed servers, and the use of legitimate hosting services combined to sustain large-scale cryptojacking activity.
Aug 14, 2026
Researchers tracked **Panda Banker**—also known as **PandaZeuS**, a Zeus-derived banking trojan—across multiple campaigns that used phishing, malvertising, and exploit-kit delivery to infect Windows users and steal credentials through **man-in-the-browser** webinjects. Reports documented active variants from `2.6.1` through `2.6.10`, including a Japanese campaign built around version `2.6.6` with 27 webinjects aimed largely at local banks and credit-card sites, as well as botnets and configs labeled **ank**, **Onore2**, **Cosmos3**, and `2.6.8`. Operators also altered Panda’s configuration encryption, apparently to hinder malware extractors and obscure controller infrastructure. Technical analyses showed Panda using staged JavaScript webinjects, backend-driven fraud workflows, screenshots, keylogging, clipboard theft, and VNC-related abuse to capture credentials and manipulate online banking sessions. The malware’s second-stage logic could identify login pages, exfiltrate victim data over HTTPS, display fake outage overlays, and guide victims into authorizing fraudulent transfers, effectively bypassing two-factor authentication through social engineering. By 2018, Panda had broadened beyond traditional financial targets to **cryptocurrency exchanges**, social media, email, ecommerce, entertainment, search, tech, and adult sites, while exposed administration panels and public config tracking highlighted a mature criminal operation with region-specific infrastructure tied to campaigns in Italy, Japan, the United States, and Latin America.
Aug 15, 2026
Researchers detailed Linux-focused cryptojacking operations that compromise internet-exposed systems through **SSH brute-force attacks** and then deploy **XMRig** to mine Monero. One campaign, tracked as **Krane**, was first observed through honeypot activity and used Bash scripts, Python tooling, and ELF binaries to establish persistence, erase and recreate logs, kill rival miners and botnets, and move laterally across additional hosts. Krane operators also used subnet and SYN scanning, SSH banner grabbing, and credential attacks to identify new victims, while infected systems reported discovered targets back to command-and-control infrastructure every 15 seconds. The reporting aligns with broader findings on long-running Linux cryptojacking activity, including the **WatchDog** campaign, which similarly maintained large-scale miner deployments over an extended period. In Krane, analysts linked delivery infrastructure to multiple download servers and network space associated with **AS53667/PONYNET**, observed package variants including `krax` and `ssh`, and tied mining activity to **Hashvault** pools and three Monero wallets. At one point, researchers saw more than 200 active miners and estimated proceeds of roughly **2434.26 EUR**, underscoring how opportunistic SSH compromise and aggressive competitor removal can sustain profitable, persistent cryptomining operations.
Aug 15, 2026