HezbThreat actor
- Mimo
Hezb is a group deploying cryptominers when new exploit are available for public facing vulnerabilities. The name is after the miner process they deploy.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1204.005Malicious Library
“The malicious library, named alamdar.so, redefines two functions readdir its 64-bits version (readdir64).”
- T1222File and Directory Permissions Modification
“These actions triggered the Sekoia Defend Sigma rules “Unusual Process Executed in Temporary Directory” and “File and Directory Permissions Modification”.”
- T1505.003Web Shell
“Step 1: The attacker activates the web shell by injecting PHP code via a specially crafted GET request, manipulating the parameter p=admin/dashboard&a=<?=exec($_GET["cmd"]);die()?>.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
The Sharp Taste of Mimo'lette: Mimo Targets Craft CMS“The Sharp Taste of Mimo'lette: Mimo Targets Craft CMS”
Indicators in its reports
named in the reports above- 85.106.113[.]168in 1 report
- n1tr0[.]onlinein 1 report
- windows.n1tro[.]cyouin 1 report
- 1aa4d88a38f5a27a…9abc29ea671ein 1 report
- 3a71680ffb4264e0…2125a98b94aain 1 report
- fc04f1ef05847607…252c18dd7a62in 1 report
- 7868cb82440632cc…daf1d108ee9ain 1 report
- 2e46816450ad1b4b…b6c36bbb3fd5in 1 report
- hxxp://15.188.246[.]198/alamdar.x86_64in 1 report
- 15.188.246[.]198in 1 report
- hxxp://15.188.246[.]198/4l4md4r.shin 1 report
- hxxp://15.188.246[.]198/hezb.x86_64in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.