8220 Gang
8220 Gang, also known as Water Sigbin, is a financially motivated, China-based threat actor/intrusion set focused primarily on deploying cryptocurrency-mining malware, especially XMRig/CoinMiner, to hijack victim resources. The group has been described as active since at least 2017 and has targeted vulnerable cloud environments, Windows and Linux web servers, VMware Horizon servers, Oracle WebLogic servers, and misconfigured containerized environments. Reported sectors and geographies include healthcare, telecommunications, financial services, Korean energy-related companies, and victims in the United States, South Africa, Spain, Colombia, Mexico, Asia, and South America. Across the provided reporting, the group is associated with opportunistic mass exploitation of public-facing applications, including Oracle WebLogic vulnerabilities CVE-2017-3506, CVE-2017-10271, CVE-2019-2725, CVE-2020-14883 (often with CVE-2020-14882), CVE-2023-21839, Atlassian Confluence vulnerabilities CVE-2021-26084 and CVE-2022-26134, and Apache Log4j/Log4Shell CVE-2021-44228 affecting VMware Horizon. The actor has also been reported exploiting WebLogic via crafted XML over HTTP requests. Observed tradecraft includes PowerShell on Windows and shell/Python scripts on Linux; use of cURL, wget, lwp-download, python urllib, and PowerShell WebClient for payload retrieval; obfuscation through base64 encoding, hexadecimal-encoded URLs, environment-variable-based batch script concealment, and HTTP over port 443; fileless execution using .NET reflection; reflective DLL injection; process hollowing; scheduled tasks, cron jobs, and systemd services for persistence; disabling or bypassing security tooling including AMSI and cloud protection tools; modifying SELinux settings and /etc/ld.so.preload; deleting logs; killing competing miners; and lateral movement via SSH brute force and SSH key abuse. Malware and tooling directly mentioned in the content include Hadooken, K4Spreader, Tsunami, ScrubCrypt, PureCrypter, AgentTesla, rhajk, nasqa, dbused, spirit, spirit-pro, hxx, px, pasx, and XMRig/CoinMiner. Tsunami is described as an IRC-controlled backdoor used for remote control, botnet activity, and DDoS capability. Sub-clusters or related naming in the content include Water Sigbin as an alias for the 8220 Gang.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
19 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
Associated vulnerabilities
6 CVEs this actor has used in observed campaigns. 6 of them exploited in the wild.
Water Sigbin exploited the vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner via a PowerShell script... We found the threat actor exploiting vulnerabilities with Oracle WebLogic server CVE-2017-3506 (a vulnerability allowing remote OS command execution)...
Ahnlab Security Emergency response Center (ASEC) has recently confirmed that the 8220 Gang attack group is using the Log4Shell vulnerability to install CoinMiner in VMware Horizon servers. Log4Shell (CVE-2021-44228) is both a remote code execution vulnerability and the Java-based logging utility Log4j vulnerability...
In November 2017, it used the Weblogic deserialization vulnerability (CVE- 2017-10271) invading a server and implanting a mining Trojan.
Currently, there are few samples and the following vulnerabilities are exploited. CVE_2020_14882
The group targets not only global systems but also Korean ones. ASEC has introduced a case where the attack group abused the Atlassian Confluence server vulnerability CVE-2022-26134 to attack Korean systems and install CoinMiner.
1 more CVE tied to this actor tracked in Mallory.
Observables
29 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Opportunistic cloud-focused intrusion set exploiting Oracle WebLogic vulnerabilities to compromise Windows and Linux cloud servers, disable security tooling, spread laterally via SSH brute force, establish persistence (cron/systemd), and deploy Monero cryptominers; also deploys the Tsunami IRC-controlled backdoor for botnet/DDoS capability.
Water Sigbin is known for exploiting Oracle WebLogic vulnerabilities to deploy cryptocurrency miners, specifically using a sophisticated multi-stage, fileless malware delivery chain that leverages reflective DLL injection, process injection, and anti-debugging techniques. The group primarily deploys the PureCrypter loader and XMRig miner, focusing on evasion and persistence.
China-based threat actor active since at least 2017 that focuses on deploying cryptocurrency-mining malware, primarily in cloud-based environments and Linux servers, and in this campaign exploited Oracle WebLogic vulnerabilities to deliver a miner while using layered obfuscation and fileless execution techniques.
The 8220 gang is a financially motivated threat actor known for mass deployment of cryptojacking malware targeting both Windows and Linux web servers. They exploit well-known vulnerabilities in public-facing applications to propagate malware, primarily for illicit cryptocurrency mining. Their operations are opportunistic, targeting a range of industries and geographies, and they frequently reuse infrastructure and TTPs.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.