Datadog Security Labs · Crawled Jul 25, 2026
Beyond Mimo’lette: Tracking Mimo's Expansion to Magento CMS and Docker | Datadog Security Labs
21 IoCs 1 Actors 1 Malware
Read original article ↗
AI Summary
The Mimo threat actor, previously known for targeting Craft CMS, has expanded its operations to compromise Magento CMS platforms and misconfigured Docker instances through PHP-FPM vulnerabilities. The actor employs sophisticated persistence and evasion techniques, including GSocket-based reverse shells, in-memory execution via memfd_create(), and process masquerading to mimic kernel threads. Mimo monetizes compromised systems through cryptojacking using XMRig and proxyjacking via IPRoyal Pawns, indicating a dual revenue strategy. This evolution reflects increased operational sophistication and a broader targeting scope beyond CMS platforms.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 21 extracted
| Type | Value | Detail |
|---|---|---|
| IP | 109[.]205[.]213[.]203 | Details → |
| IP | 193[.]32[.]162[.]10 | Details → |
| IP | 15[.]188[.]246[.]198 | Details → |
| Domain | g[.]gsocket[.]ninja | Details → |
| Domain | d[.]gsocket[.]ninja | Details → |
| SHA-256 | 2171deb9293361fd801691948264ad8dc7864935140834449307d040a6d67787 | Details → |
| Filename | gsocket.sh | Details → |
| SHA-256 | d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa | Details → |
| Filename | gs-netcat_mini-linux-x86_64 | Details → |
| SHA-256 | 4dcae1bddfc3e2cb98eae84e86fb58ec14ea6ef00778ac5974c4ec526d3da31f | Details → |
| Filename | 2022 | Details → |
| SHA-256 | bf2727a50a1c083fe478de1e51bded8a8eea6d6f1d02855161df8be42965f976 | Details → |
| Filename | 4l4md4r.sh | Details → |
| SHA-256 | ef108d6f7d9f2fe240a32f2cde594d3e54319237cedd21d13ab5e10ad4d05dbb | Details → |
| Filename | 4l4md4r | Details → |
| SHA-256 | 7868cb82440632cc4fd7a451a351c137a39e1495c84172a17894daf1d108ee9a | Details → |
| Filename | alamdar.so | Details → |
| SHA-256 | 4f509762ff7a65e56780f5b1fee10aaed267fe4b15182059480541fc7ce47923 | Details → |
| Filename | xmrig-C3 | Details → |
| SHA-256 | 1aa4d88a38f5a27a60cfc6d6995f065da074ee340789ed00ddc29abc29ea671e | Details → |
| Filename | hezb.x86_64 | Details → |
MITRE ATT&CK TTPs 61 techniques
T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1078.001 Default Accounts · Defense Evasion T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1129 Shared Modules · Execution T1203 Exploitation for Client Execution · Execution T1212 Exploitation for Credential Access · Credential Access T1543.001 Launch Agent · Persistence T1543.002 Systemd Service · Persistence T1548.004 Elevated Execution with Prompt · Privilege Escalation T1566 Phishing · Initial Access T1570 Lateral Tool Transfer · Lateral Movement T1003.002 Security Account Manager · Credential Access T1012 Query Registry · Discovery T1021.002 SMB/Windows Admin Shares · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1027.002 Software Packing · Defense Evasion T1027.003 Steganography · Defense Evasion T1027.013 Encrypted/Encoded File · Defense Evasion T1036.005 Match Legitimate Name or Location · Defense Evasion T1053.003 Cron · Execution T1053.005 Scheduled Task · Execution T1055 Process Injection · Defense Evasion T1056.002 GUI Input Capture · Collection T1057 Process Discovery · Discovery T1060 T1060 T1070.004 File Deletion · Defense Evasion T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1085 T1085 T1089 T1089 T1095 Non-Application Layer Protocol · Command And Control T1102.001 Dead Drop Resolver · Command And Control T1106 Native API · Execution T1110 Brute Force · Credential Access T1110.001 Password Guessing · Credential Access T1112 Modify Registry · Defense Evasion T1113 Screen Capture · Collection T1133 External Remote Services · Persistence T1135 Network Share Discovery · Discovery T1140 Deobfuscate/Decode Files or Information · Defense Evasion T1160 T1160 T1170 T1170 T1190 Exploit Public-Facing Application · Initial Access T1195.001 Compromise Software Dependencies and Development Tools · Initial Access T1197 BITS Jobs · Defense Evasion T1204.002 Malicious File · Execution T1205.001 Port Knocking · Defense Evasion T1484.001 Group Policy Modification · Defense Evasion T1485 Data Destruction · Impact T1490 Inhibit System Recovery · Impact T1543.003 Windows Service · Persistence T1548.002 Bypass User Account Control · Privilege Escalation T1555.003 Credentials from Web Browsers · Credential Access T1558 Steal or Forge Kerberos Tickets · Credential Access T1564.003 Hidden Window · Defense Evasion T1574.002 DLL Side-Loading · Persistence T1608.001 Upload Malware · Resource Development T1685 T1685