Threat Actor Unknown origin

Hezb

Also known as: Mimo

Hezb is a group deploying cryptominers when new exploit are available for public facing vulnerabilities. The name is after the miner process they deploy.

Indicators of Compromise 21

Domain d[.]gsocket[.]ninja Domain g[.]gsocket[.]ninja Filename 2022 Filename 4l4md4r Filename 4l4md4r.sh Filename alamdar.so Filename gs-netcat_mini-linux-x86_64 Filename gsocket.sh Filename hezb.x86_64 Filename xmrig-C3 SHA-256 1aa4d88a38f5a27a60cfc6d6995f065da074ee340789ed00ddc29abc29ea671e SHA-256 2171deb9293361fd801691948264ad8dc7864935140834449307d040a6d67787 SHA-256 4dcae1bddfc3e2cb98eae84e86fb58ec14ea6ef00778ac5974c4ec526d3da31f SHA-256 4f509762ff7a65e56780f5b1fee10aaed267fe4b15182059480541fc7ce47923 SHA-256 7868cb82440632cc4fd7a451a351c137a39e1495c84172a17894daf1d108ee9a SHA-256 bf2727a50a1c083fe478de1e51bded8a8eea6d6f1d02855161df8be42965f976 SHA-256 d94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa SHA-256 ef108d6f7d9f2fe240a32f2cde594d3e54319237cedd21d13ab5e10ad4d05dbb IP 109[.]205[.]213[.]203 IP 15[.]188[.]246[.]198 IP 193[.]32[.]162[.]10

MITRE ATT&CK TTPs 13

T1059.001
PowerShell
Execution
 T1071.001
Web Protocols
Command And Control
 T1078.001
Default Accounts
Defense Evasion
 T1090
Proxy
Command And Control
 T1105
Ingress Tool Transfer
Command And Control
 T1129
Shared Modules
Execution
 T1203
Exploitation for Client Execution
Execution
 T1212
Exploitation for Credential Access
Credential Access
 T1543.001
Launch Agent
Persistence
 T1543.002
Systemd Service
Persistence
 T1548.004
Elevated Execution with Prompt
Privilege Escalation
 T1566
Phishing
Initial Access
 T1570
Lateral Tool Transfer
Lateral Movement

Source Articles

Beyond Mimo’lette: Tracking Mimo's Expansion to Magento CMS and Docker | Datadog Security Labs
The Mimo threat actor, previously known for targeting Craft CMS, has expanded its operations to compromise Magento CMS platforms and misconfigured Docker instances through PHP-FPM vulnerabilities. The actor employs sophisticated persistence and evasion techniques, including GSocket-based reverse shells, in-memory execution via memfd_create(), and process masquerading to mimic kernel threads. Mimo monetizes compromised systems through cryptojacking using XMRig and proxyjacking via IPRoyal Pawns, indicating a dual revenue strategy. This evolution reflects increased operational sophistication and a broader targeting scope beyond CMS platforms.
Datadog Security Labs