PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Soco404: Multiplatform Cryptomining Campaign Uses Fake Error Pages to Hide Payload

wiz.io | blog | #cloud-security | #malware | #postgresql | #threat-research | #cryptomining | #soco404
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz tracks Soco404, a cryptomining campaign abusing PostgreSQL misconfigurations: it hits Linux and Windows, masquerades as system processes, hiding payloads in fake 404 pages on Google Sites.
Published
Collected

Related coverage

blog · wiz.io
CPU_HU: Fileless cryptominer targeting exposed PostgreSQL with over 1.5K victims
Wiz Threat Research details JINX-0126, which abuses weak PostgreSQL credentials to run fileless XMRig-C3 cryptominers while dodging hash-based detection; C3Pool data suggests over 1,500 victims.
blog · wiz.io
Unpacking Diicot - Evolving Campaign Targeting Linux Environments
Wiz Threat Research details an evolved Diicot (Mexals) campaign targeting Linux—corrupted UPX headers that defeat unpacking, HTTP-based C2, and cloud-aware payloads that spread or mine crypto.
blog · wiz.io
SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining
Wiz Research documented SeleniumGreed, an active campaign exploiting exposed, unauthenticated Selenium Grid services to run reverse shells and install XMRig cryptominers via the WebDriver API.
blog · wiz.io
Key takeaways from the Wiz 2023 Kubernetes Security Report
Highlights from Wiz's 2023 Kubernetes Security Report, based on 200,000+ scanned cloud accounts: new clusters face malicious scans within 22 minutes, kubelet endpoints sit exposed, cryptomining rises.
blog · wiz.io
Wiz in the Verizon DBIR: How AI Acceleration and Cloud Sprawl Impact Modern Defense
Wiz's contribution to the 2026 Verizon DBIR: exploitation is now the top initial access vector (31% of breaches) and only 26% of known exploited vulnerabilities were remediated.
blog · wiz.io
Cloud Threats Retrospective 2026: What AI Changed (and What It Didn’t)
Wiz's Cloud Threats Retrospective: 80% of 2025 intrusions began with known weaknesses — vulnerabilities, exposed secrets, misconfigurations — while AI expanded the surface and sped up attackers.
Back