The menace actor behind the exploitation of weak Craft Content material Administration System (CMS) cases has shifted its ways to focus on Magento CMS and misconfigured Docker cases.
The exercise has been attributed to a menace actor tracked as Mimo (aka Hezb), which has an extended historical past of leveraging N-day safety flaws in numerous net functions to deploy cryptocurrency miners.
“Though Mimo’s major motivation stays monetary, by cryptocurrency mining and bandwidth monetization, the sophistication of their latest operations suggests potential preparation for extra profitable legal actions,” Datadog Safety Labs stated in a report printed this week.
Mimo’s exploitation of CVE-2025-32432, a vital safety flaw in Craft CMS, for cryptojacking and proxyjacking was documented by Sekoia in Might 2025.
Newly noticed assault chains related to the menace actor contain the abuse of undetermined PHP-FPM vulnerabilities in Magento e-commerce installations to acquire preliminary entry, after which utilizing it to drop GSocket, a professional open-source penetration testing instrument, to set up persistent entry to the host by way of a reverse shell.
“The preliminary entry vector is PHP-FPM command injection by way of a Magento CMS plugin, indicating that Mimo possesses a number of exploit capabilities past beforehand noticed adversarial tradecraft,” researchers Ryan Simon, Greg Foss, and Matt Muir stated.
In an try to sidestep detection, the GSocket binary masquerades as a professional or kernel-managed thread in order that it blends in with different processes which may be working on the system.
One other notable approach employed by the attackers is the usage of in-memory payloads utilizing memfd_create() in order to launch an ELF binary loader referred to as “4l4md4r” with out leaving any hint on disk. The loader is then accountable for deploying the IPRoyal proxyware and the XMRig miner on the compromised machine however not earlier than modifying the “/and so on/ld.so.preload” file to inject a rootkit to hide the presence of those artifacts.
The distribution of a miner and proxyware underscores a two-pronged strategy adopted by Mimo to maximise monetary achieve. The distinct income era streams be sure that compromised machines’ CPU assets are hijacked to mine cryptocurrency, whereas the victims’ unused web bandwidth is monetized for illicit residential proxy companies.
“Moreover, the usage of proxyware, which generally consumes minimal CPU, allows stealthy operation that stops detection of the extra monetization even when the crypto miner’s useful resource utilization is throttled,” the researchers stated. “This multi-layered monetization additionally enhances resilience: even when the crypto miner is detected and eliminated, the proxy part might stay unnoticed, making certain continued income for the menace actor.”
Datadog stated it additionally noticed the menace actors abusing misconfigured Docker cases which are publicly accessible to spawn a brand new container, inside which a malicious command is executed to fetch a further payload from an exterior server and execute it.
Written in Go, the modular malware comes fitted with capabilities to attain persistence, conduct file system I/O operations, terminate processes, carry out in-memory execution. It additionally serves as a dropper for GSocket and IPRoyal, and makes an attempt to propagate to different methods by way of SSH brute-force assaults.
“This demonstrates the menace actor’s willingness to compromise a various vary of companies – not simply CMS suppliers – to attain their goals,” Datadog stated.
