---
id: 7076
title: "Unpacking Diicot - Evolving Campaign Targeting Linux Environments"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/diicot-threat-group-malware-campaign"
published_at: "2024-12-17T17:31:22Z"
tags: ["cloud", "cloud-security", "malware", "linux", "threat-research", "cryptomining", "diicot"]
phying_url: "https://phying.com/item/7076"
lang: en
---

# Unpacking Diicot - Evolving Campaign Targeting Linux Environments

## Summary

Wiz Threat Research details an evolved Diicot (Mexals) campaign targeting Linux—corrupted UPX headers that defeat unpacking, HTTP-based C2, and cloud-aware payloads that spread or mine crypto.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2024-12-17T17:31:22Z
- **Original:** https://www.wiz.io/blog/diicot-threat-group-malware-campaign
- **Phying News:** https://phying.com/item/7076