Monero-mining and proxyjacking campaign on Oracle Cloud aarch64

T1110.001T1496.001T1496.002T1053.003T1059.004

Background

On 7 May 2026 a forensic investigation of a compromised Oracle Cloud aarch64 VM (Kali Rolling, kernel 5.15.0-1081-oracle) found four malicious processes running under a code-server pty session. The host had been live for 13 days before detection. The investigation produced a full static reverse-engineering pass over seven ELF samples and six shell scripts, a scrape of the operator's open Apache C2 directory, a live Stratum probe of the mining pool, and a pool-API query that confirmed real XMR payouts. None of the IOCs appear in any public threat-intel feed at time of publication.

Compromise timeline

Entry vector

code-server was bound to 0.0.0.0:8080 with password-only authentication and no rate limiting. A Go-based brute-force scanner hit the /login endpoint continuously for 13 days.

The ubuntu user had NOPASSWD: ALL sudo from OCI cloud-init defaults, so a shell as ubuntu was effectively root. code-server logs only failed attempts; successful login leaves no application-level record. The ten-minute gap between the last failed attempt and the first malicious PID is consistent with a slow password-spray finding a valid credential on the final attempt.

Kill chain

Process tree at time of detection:

systemd
└── code-server@ubuntu.service
    └── code-server (node)
        └── ptyHost
            └── bash (attacker terminal)
                ├── 1753687  watchdog: while true; pkill competitors; sleep 5
                ├── 1753707  cliaarch start accept --token uUbGvGz7zAMgGt...
                ├── 1753900  Error84 -o andrewtatemunityxcrypto.com:5555 -u error -p error
                └── 1753919  cliaarch start accept --token jUliaNLclI34oU...

Malware analysis

Error84 -- XMRig 6.24.0, aarch64

SHA256: 0c4bfa96b30bf3046a70d8a0143ed419a7cd58b55091c85da619a8a22cd31e1b

Statically linked ELF64, aarch64, 7.5 MB, stripped. No packer. The XMRig 6.24.0 version banner appears twice in strings alongside the full algorithm table (randomx, cryptonight-monerov*, argon2/*, etc.) and the upstream dev-donate fallback URL. Built on Alpine 14.2.0 (GCC 14.2.0) -- upstream XMRig ships no Linux-aarch64 static binary, so this is operator-compiled.

No embedded config. Configured purely from CLI flags at runtime:

./Error84 -o andrewtatemunityxcrypto.com:5555 -u error -p error

At capture: ESTAB 10.0.0.166:53168 -> 94.26.106.195:5555. The pool proxy accepts any credential; the operator's wallet is substituted server-side.

syst3md / log -- XMRig 6.22.2, x86_64 (November 2025 build)

SHA256: dcf343df280816c4856ee164b9b4b14906a09b1fd4bfab604ee9370529ed61d1 (both files byte-identical)

Dynamically linked ELF64, x86_64, 9.4 MB, stripped. Built on Ubuntu 14.04 Trusty with GCC 7.5.0 -- an EOL backport chosen for maximum glibc compatibility. The two files are the same blob written under two names so persistence survives if one is killed.

Unlike Error84, this build has a full embedded config.json in .rodata with "donate-level": 0 and 16 pool entries spanning OVH FR relays, the operator's own Stratum proxy, SupportXMR, C3Pool, and DNS-decoy entries (114.114.114.114, 77.88.8.8, 157.240.7.8 -- these are DNS resolvers, not mining pools; they serve as config noise).

wd1337 -- XMRig 6.22.2, x86_64 (April 2026 rebuild)

SHA256: 49dfdc259084a9ecf7795fb1464a28091cf44df3df6b2486e5fcce55959d08b7

Same codebase and build environment as syst3md/log, rebuilt on 2026-04-28. The embedded config differs in two ways: the pool list collapses from 16 entries to a single private proxy at 57.129.119.218:13333 (see Huntress crossover below), and the wallet rotates to a vanity address with the substring Rcbbb. The name wd1337 is misleading; this is another XMRig binary, not the watchdog. The actual watchdog is the bash loop under PID 1753687.

cliaarch / cli -- Traffmonetizer Rust client v1.3.2

cliaarch SHA256: 8253ac8b47e87a05c203f6ba97f81dcd7026ae207363602f8cea217b5835dbff (aarch64)
cli SHA256: c21fa4c1d6ed5342e49ef0561cc566a2cbe06a83f6298374fe9cb4f8027b6911 (x86_64)

Both are the official Traffmonetizer Rust client, not modified. Identification is unambiguous: the balance API hostname nameblnc.traffmonetizer.com, the misspelt status field BallanceResponse (a high-confidence YARA anchor), the persistence file cli_device_ids.json, and the version concatenation handshake start1.3.2 all match the Traffmonetizer product exactly. The Cargo workspace source paths (/app/src/client.rs, /app/src/client/balancer.rs, etc.) are upstream Traffmonetizer's own build system.

The binary opens a TLS connection to a Traffmonetizer balancer, receives an aggregator IP assignment, and connects to that aggregator on TCP/769 (observed: Hetzner hosts 142.132.220.35 and 46.4.113.203). Each do_tunnel message proxies a request through the victim's residential bandwidth. The operator ran two instances simultaneously under different account tokens, violating Traffmonetizer's one-account-per-IP ToS.

The two device tokens are 32 bytes of raw entropy after base64 decode -- no JWT structure, no name embedded. The "jUliaN" appearance in one token is base64 noise, not a name.

Shell scripts

check1.sh (aarch64 second-stage): installs the cron heartbeat, kills competing miners and proxy clients via pkill -f, downloads and runs Error84 and cliaarch, then wipes auth.log, wtmp, btmp, lastlog, utmp, and .bash_history. Romanian-language comments with correct diacritics throughout:

# Verifică și adaugă linia în crontab dacă nu există
# Verifică dacă procesul Error84 rulează
# Rulează comenzile dacă procesul nu este găsit

auto: branches on uname -m between aarch64 and x86_64, fetching the appropriate check script. Uses both curl | bash and wget; bash for redundancy.

checkmacos.sh: identical structure but points to a secondary C2 at 149.28.129.194 (Vultr, now dead). The macOS payload itself was never retrieved.

traff / traffaarch: launchers that bake both Traffmonetizer tokens and run two client instances per host.

proot

SHA256: b7f2adf5a225000a164f4905aabefeebe11c4c1d5bedff5e1fe8866c48dd70d2

Upstream PRoot v5.3.1 (git tag 99a8417521645c6d0b6d2b64a504bf27fea5d4da), not stripped, includes DWARF. Staged to allow the operator to run x86_64 binaries on aarch64 hosts without binfmt-misc. On this victim it was never invoked because native aarch64 binaries were available.

Operator attribution

Confidence: medium. The linguistic, temporal, and infrastructure evidence is consistent with a single Romanian-speaking author operating at hobby cadence.

Language. Three dropper scripts contain diacritic-correct literary Romanian. The phrasing is natural dev-dialect: Verifică și adaugă linia în crontab dacă nu există is how a Romanian developer would write it for themselves, not how Google Translate renders it. The English error string [!] the line not exit in crontab reload has verb-phrase order typical of Romanian syntax (linia nu există = "the line not exist"). The test.txt file on the C2 contained merge boss -- merge is Romanian present indicative of a merge ("to run/work"), so the string reads "it works, boss" in Romanian dev register.

Infrastructure and timing. C2 modifications cluster into five short bursts over 5.5 months, all within the EET/EEST working-hours window (12:34--17:52 local time), with one Sunday-night outlier. Long gaps of three to seven weeks between bursts are inconsistent with a team and consistent with a single author working evenings and weekends.

Build-host fingerprint. The x86_64 XMRig variants link against Ubuntu 7.5.0-3ubuntu1~14.04.1 (Ubuntu Trusty, EOL since 2024). Both the November 2025 and April 2026 builds use the same environment, indicating the operator retained the same build machine for at least six months. The aarch64 XMRig links against Alpine 14.2.0 GCC. Any other XMRig sample linking against Ubuntu 7.5.0-3ubuntu1~14.04.1 is likely the same operator or the same shared build farm in this cluster.

Diicot/Mexals adjacency. The combination of Romanian-language dropper scripts, custom XMRig builds with embedded configs, cron-based persistence, a watchdog that kills competing miners, and /var/tmp/ staging closely follows the published Diicot/Mexals playbook (Bitdefender 2023, Akamai 2023, Wiz 2023). This actor differs in two respects: the initial access vector is code-server brute force (not SSH), and the monetization adds Traffmonetizer proxyjacking on top of mining (not reported in any Diicot writeup). No IOC overlap with published Diicot clusters exists. This is treated as a Diicot-adjacent actor rather than a positive Diicot ID.

Skill assessment. Competent enough to compile multi-arch XMRig, maintain separate build pipelines, and implement a turf-war watchdog. Careless about operational security in ways that leave forensic leverage: cleartext HTTP for all payload delivery, wallets embedded in plaintext in .rodata, a default Apache directory listing exposing the entire toolkit, and the standard Go-http-client/1.1 user-agent on the brute-force scanner.

Hands-on-keyboard IP. 185.241.208.217 (AS210558, 1337 Services GmbH, brand rdp.sh) made two successful management connections to code-server on 2026-05-03 and 2026-05-05, the latter within a minute of the auto dropper being re-deployed. This is a no-KYC bulletproof host with a deliberately AWS-impersonating PTR record (*.powered.by.amazon.com).

Financial trail

A SupportXMR API query from a Tor exit on 2026-05-07 returned live payout data for two of the three wallets. XMR price at query time: $416.14.

Wallet 1 hits SupportXMR's 0.1-XMR auto-payout threshold roughly every 24 hours. At $42/day from W1 alone and approximately $6/day from W2, the visible SupportXMR run-rate is around $1,500/month. This excludes earnings from the private pool at 57.129.119.218:13333 (wd1337 only, not queryable) and Traffmonetizer income (estimated $50--200/month from peer reports). Infra costs across five VPS rentals are $60--150/month. Net to the operator: approximately $1,400--1,600/month visible, probably higher with the private pool.

Worker identifiers exposed by the pool API: ["C4", "proxy"] for W1 and ["C4"] for W2. The literal C4 matches the "pass": "C4" field embedded in every XMRig config. The operator was disciplined enough not to use hostnames as worker IDs, so victim enumeration via the pool API produced nothing.

At 1.74 MH/s aggregate, the operator's botnet is roughly 50--250 victim CPUs, depending on CPU generation.

Huntress crossover: the FH8a7d7M cryptominer

Huntress's Codex Part Two writeup names 57.129.119.218 as a "private Monero mining pool used by the FH8a7d7M cryptominer." This is the sole pool configured in wd1337, the newest binary on the C2 (built 2026-04-28). The overlap on a private pool that appears in neither public pool directories nor any other known campaign makes it highly probable that FH8a7d7M is Huntress's internal tracking label for this operator. Huntress likely has victim telemetry from endpoints running their agent; correlating their FH8a7d7M case against the IOC bundle below should be productive.

C2 and operator infrastructure

The C2 runs an unmodified Apache 2.4.41 (Ubuntu 20.04) with default directory listing enabled. The operator has not patched or reconfigured it since deployment. A Stratum probe of 94.26.106.195:5555 confirmed the pool was live and accepting any credential at time of investigation, returning real RandomX work at Monero chain height 3668817. The proxy uses 15-digit decimal session IDs, returns a fixed 436-byte template, and is silent on unknown methods -- consistent with custom Go or Rust proxy code rather than stock xmrig-proxy.

IOCs

Binary hashes

Network

Monero wallets

46d1re6b3qvSAeTgn9AvVk1D1JJCLEjnUDnzTPXewT8cPgbPfAU2DifdqiQQWMMTSV8qPiVx9jLY9MWxv9Qw8FmCK2xH9Mg
  -- W1, primary (syst3md/log embedded config, SupportXMR confirmed)

47qQHFXfGixiVEjwPNaVpQ8LJ6p8xNPHLjWKZC86us4WfhxacyXivPAGoThcgbwUaiAi4CjveFdsMLEYEUMhhrLA4nrCgHe
  -- W2, operator proxy rebadge (andrewtatemunityxcrypto.com:5555 only)

46nLNch8se4Z15e4UCEfu9NnHtTVXqFDbaWssR8j9jBSbhPtRcbbb678serCXkRWnxHPHpUXtkthUT5RXa6WLHv9Qs4i7QX
  -- W3, vanity-mined rotation (wd1337, Apr 2026)

Traffmonetizer device tokens

uUbGvGz7zAMgGtHsTo8EOi1krvj+OPi7SF5UMeoCJnU=
jUliaNLclI34oUpjC7ewra/HjEuw+UgYa7jrpxMBC3k=

These are per-account 32-byte opaque secrets. Reporting them to Traffmonetizer (Bytemarket OU, Tallinn) with forensic evidence of installation on non-consenting devices should trigger account freezes and disrupt the proxyjacking income stream.

Filesystem indicators

/var/tmp/Error84, /var/tmp/cliaarch, /var/tmp/cli
/var/tmp/syst3md, /var/tmp/log, /var/tmp/wd1337, /var/tmp/auto
/etc/systemd/system/log.service  (ExecStart=/usr/bin/log -sshd)
/tmp/report_system.lock
crontab line containing: 94.26.106.195

Detection rules

YARA

rule apt_xmrig_renamed_aarch64_Error84
{
    meta:
        description = "XMRig 6.24.0 aarch64, statically linked, renamed"
        sha256      = "0c4bfa96b30bf3046a70d8a0143ed419a7cd58b55091c85da619a8a22cd31e1b"
        mitre       = "T1496.001"
    strings:
        $banner         = "XMRig 6.24.0" ascii
        $algo_t1        = "cryptonight-monerov7" ascii
        $algo_t2        = "randomx" ascii
        $stratum_donate = "stratum+ssl://randomx.xmrig.com:443" ascii
    condition:
        uint32(0) == 0x464C457F and $banner
        and 2 of ($algo_t1, $algo_t2, $stratum_donate)
}

rule apt_xmrig_renamed_x86_64_syst3md_wd1337
{
    meta:
        description = "XMRig 6.22.2 x86_64 with embedded operator config"
        mitre       = "T1496.001"
    strings:
        $banner      = "XMRig 6.22.2" ascii
        $donate0     = "\"donate-level\": 0," ascii
        $pass_C4     = "\"pass\": \"C4\"," ascii
        $wallet1     = "46d1re6b3qvSAeTgn9AvVk1D1JJCLEjnUDnzTPXewT8c" ascii
        $wallet3     = "46nLNch8se4Z15e4UCEfu9NnHtTVXqFDbaWssR8j9jBSb" ascii
        $pool_op     = "andrewtatemunityxcrypto.com:5555" ascii
        $pool_new    = "57.129.119.218:13333" ascii
    condition:
        uint32(0) == 0x464C457F and $banner
        and (any of ($wallet1, $wallet3) or any of ($pool_op, $pool_new))
}

rule traffmonetizer_rust_client_proxyjacking
{
    meta:
        description = "Traffmonetizer Rust client v1.3.2 (gate on context)"
        mitre       = "T1496.002"
    strings:
        $bal_typo  = "BallanceResponse" ascii   // misspelt -- high signal
        $api_host  = "nameblnc.traffmonetizer.com" ascii
        $persist   = "cli_device_ids.json" ascii
        $rust_src1 = "/app/src/client.rs" ascii
        $rust_src2 = "/app/src/messaging.rs" ascii
        $ver       = "handshake start1.3.2" ascii
    condition:
        uint32(0) == 0x464C457F and $api_host
        and 2 of ($bal_typo, $persist, $rust_src1, $rust_src2)
}

rule dropper_romanian_andrewtatemunity
{
    meta:
        description = "Romanian-language dropper with C2 reference and log wipe"
        mitre       = "T1059.004,T1070.002,T1053.003"
    strings:
        $ro1        = "Verifică și adaugă linia în crontab" ascii wide
        $ro2        = "Verifică dacă procesul" ascii wide
        $ro3        = "Rulează comenzile dacă procesul nu este găsit" ascii wide
        $c2         = "94.26.106.195" ascii
        $wipe       = "rm -rf auth.log" ascii
        $cron       = "*/5 * * * * /usr/bin/bash" ascii
    condition:
        any of ($ro*) and ($c2 or $wipe or $cron)
}

rule iocs_traffmonetizer_operator_tokens
{
    meta:
        description = "Operator Traffmonetizer tokens -- critical if found outside known install"
        mitre       = "T1078"
    strings:
        $tok1 = "uUbGvGz7zAMgGtHsTo8EOi1krvj+OPi7SF5UMeoCJnU="
        $tok2 = "jUliaNLclI34oUpjC7ewra/HjEuw+UgYa7jrpxMBC3k="
    condition:
        any of them
}

Sigma (selected)

title: Cron job fetching from andrewtatemunity C2
id: 6f0f9c19-2e7e-4f4d-89bd-94c109af1f6a
status: stable
tags: [attack.persistence, attack.t1053.003]
logsource: { product: linux, service: auditd }
detection:
  cron_c2:
    CommandLine|contains:
      - '94.26.106.195'
      - 'andrewtatemunityxcrypto.com'
      - '149.28.129.194'
  cron_marker:
    CommandLine|contains:
      - '*/5 * * * *'
      - 'check1.sh'
  condition: cron_c2 and cron_marker
level: high

---
title: code-server brute-force spike followed by /var/tmp exec
id: 0d2a8f73-7f76-4e3c-9b8a-19e1c6c6ad21
status: experimental
tags: [attack.initial_access, attack.t1110.001, attack.execution, attack.t1059.004]
detection:
  failed_login:
    message|contains: 'Failed login attempt'
    message|contains: '"userAgent":"Go-http-client/1.1"'
  exec_followup:
    ParentImage|contains: 'code-server'
    CommandLine|contains: ['/var/tmp/', 'http://94.26.106.195']
  condition:
    failed_login | count() by remoteAddress > 200
    | within 30m
    | followed by exec_followup
level: critical

---
title: Mass /var/log and utmp wipe in single shell pipeline
id: bf8c0e14-9e6a-4ce6-99e5-9fb3c6d01b9c
status: stable
tags: [attack.defense_evasion, attack.t1070.002]
detection:
  shell:
    Image|endswith: '/bash'
    CommandLine|contains: 'rm -rf'
  multi_wipe:
    CommandLine|contains|all:
      - '/var/log/auth.log'
      - 'wtmp'
      - 'btmp'
  condition: shell and multi_wipe
level: critical

Suricata (selected)

alert http $HOME_NET any -> any any (
    msg:"ZNTRAQ andrewtatemunity C2 -- HTTP to 94.26.106.195";
    flow:to_server,established;
    http.host; content:"94.26.106.195"; nocase;
    classtype:trojan-activity; sid:4000001; rev:1;)

alert tcp $HOME_NET any -> [94.26.106.195,57.129.119.218,141.94.96.71] any (
    msg:"ZNTRAQ andrewtatemunity Stratum to operator pool";
    flow:to_server,established;
    content:"{\"jsonrpc\""; nocase;
    classtype:trojan-activity; sid:4000011; rev:1;)

alert dns $HOME_NET any -> any any (
    msg:"ZNTRAQ andrewtatemunity -- pool domain DNS query";
    dns.query; content:"andrewtatemunityxcrypto.com"; nocase;
    classtype:trojan-activity; sid:4000020; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 769 (
    msg:"ZNTRAQ proxyjacking -- TCP/769 outbound (Traffmonetizer pattern)";
    flow:to_server,established;
    classtype:policy-violation; sid:4000030; rev:1;)

alert http any any -> $HOME_NET 8080 (
    msg:"ZNTRAQ code-server brute force -- Go-http-client/1.1";
    flow:to_server,established;
    http.user_agent; content:"Go-http-client/1.1";
    http.uri; content:"/login";
    threshold: type threshold, track by_src, count 5, seconds 60;
    classtype:attempted-admin; sid:4000040; rev:1;)

alert ip [91.224.92.34,141.98.11.174,185.241.208.217] any -> $HOME_NET any (
    msg:"ZNTRAQ andrewtatemunity -- known attacker IP";
    classtype:trojan-activity; sid:4000041; rev:1;)

Disclosure and action items

Recommended steps for defenders and researchers:

Submit the binary hashes to MalwareBazaar and ThreatFox with the YARA rules above. File the domains with Porkbun (abuse@porkbun.com) and Cloudflare abuse for andrewtatemunityxcrypto.com. Report the two Traffmonetizer tokens to admin@traffmonetizer.com citing ToS non-consenting device install -- this is the cheapest action with a meaningful chance of disrupting the proxyjacking income. File OVH abuse for 57.129.119.218, 141.94.96.71, and 54.38.33.16. Contact Huntress with the IOC bundle to merge tracking against the FH8a7d7M case. CERT-RO is the appropriate national contact given the linguistic and likely-Romanian origin.

Do not poison or exploit the operator's open C2 directory. The open listing is a free intelligence feed; leaving it intact allows continued passive observation of any new file additions.