Mimo

Mimo, also known as Hezb, is a financially motivated intrusion set active since at least 2022 that is primarily associated with opportunistic exploitation of internet-facing vulnerabilities to monetize compromised systems. The group is best known for deploying XMRig cryptominers and residential proxyware, and has also been linked to ransomware activity involving the Go-based Minus ransomware and later use of the Go-based 4L4MD4r ransomware. Its operations indicate a pragmatic revenue-driven model centered on cryptojacking, bandwidth monetization, and, at times, ransomware deployment. Mimo has repeatedly exploited N-day and recently disclosed vulnerabilities in public-facing applications, including CMS platforms and Microsoft SharePoint, to gain unauthenticated remote code execution. In observed Craft CMS intrusions, the actor used a multi-stage infection chain that began with server-side code execution and webshell deployment, followed by retrieval of shell scripts and Golang loaders that installed a miner and IPRoyal proxyware. The actor also used LD_PRELOAD-based userland rootkit techniques to hide malicious processes, cleared or replaced competing persistence mechanisms, and killed rival miners and proxyware to maximize monetization of victim resources. The group demonstrates post-compromise tradecraft focused on persistence, defense evasion, and resource control rather than deep bespoke espionage. Reported behaviors include command execution through webshells, deployment of loaders and shared libraries, process hiding, privilege-seeking behavior, and removal of competing malware. Mimo has also been observed expanding its vulnerability targeting across CMS ecosystems, suggesting ongoing reconnaissance and rapid weaponization of newly disclosed flaws. Attribution reporting has associated recurring operator identifiers such as Hezb and 4L4MD4r with the cluster. Evidence in the supplied material suggests a likely operator presence in Turkey, but the geographic attribution remains limited. Overall, Mimo is best characterized as a cybercriminal intrusion set focused on financially motivated exploitation of exposed servers for cryptomining, proxy monetization, and occasional ransomware operations.