"The Usual Suspects"

James Condon, head of security and research at IastWork, examines prolific threat actor groups conducting cryptojacking campaigns against cloud infrastructure. The research begins with honeypot deployments of Redis instances that revealed multiple competing threat actors killing each other's processes while establishing Monero mining operations.

Three primary Chinese-speaking criminal threat actor groups are analyzed:

**8220 Mining Group** (active since 2017) primarily targets internet-facing, unpatched systems including Drupal, Apache, Redis, JBoss, Jenkins, Docker, and Kubernetes. They operate the WhatMiner GitHub repository containing coin mining tools, use TCP port 8024 for C2 communications, and employ consistent naming schemes like "Kwork" and "Suos." They leverage Lib Process Haider to hide running processes without kernel modules and host tools on Pastebin and GitHub.

**Rock** (active since 2018) targets a broader range of platforms including Windows, Android, and Chrome. A notable April 2019 Confluence campaign demonstrated their reach. The group evolved from basic Pastebin shell scripts to dedicated infrastructure and DNS TXT record C2. Rock notably forks 8220's tools, replaces infrastructure with their own, actively uninstalls cloud security products (particularly Alibaba and Tencent tools), and attempts to delete ELF library preloads used by competitors.

**PATA Group** distinguishes itself through advanced anti-analysis and evasion techniques, implementing process killing in compiled malware rather than bash scripts. They specifically hunt for web shells and aggressively target Rock's infrastructure.

Standard attack methodology involves scanning for vulnerable applications, executing initial access exploits, then downloading bash scripts that kill competing miners, disable security tools, remove CPU throttling controls, download additional malware, and establish persistence via cron jobs or systemd services.

Common malware tools include XMrig (legitimate Monero mining software repurposed), Lib Process Haider, and shell scripts. Process-killing techniques observed include keyword grepping, IP address targeting, network connection-based killing via netstat, IPtables blocking, /etc/hosts sinkholing, and Docker image removal. Analysis found most common targeted processes are "/tmp/java" (Rock) and "ustedes" (8220).

Key observations include deliberate CPU throttling (~30% limitation) for stealth persistence, continuous tactic evolution, and Kubernetes daemon set attacks using vanilla CentOS images. Honeypot survival times vary—small instances last approximately one week, while sophisticated actors with throttled resources persist indefinitely. Detection typically occurs through billing alerts rather than security tools.

Prevention emphasizes key-based SSH authentication over passwords, aggressive patching (critical given week-long POC timelines post-disclosure), and application exposure restriction. Monero dominates cryptojacking due to superior anonymity compared to Bitcoin, driving economic preference among criminal actors.