Full Report
The threat actor known as Mimo (or Mimo’lette) has expanded its intrusion operations from Craft CMS to the Magento ecommerce platform, Docker environments, and cloud instances. Mimo exploits PHP-FPM vulnerabilities in Magento to gain initial access, establishes persistence usi...
Analysis Summary
# Threat Actor: Mimo (Mimo’lette)
## Attribution & Identity
- **Identification:** Threat actor known as Mimo or Mimo’lette.
- **Known Aliases/Associations:** No specific threat group association mentioned beyond the name Mimo/Mimo’lette.
## Activity Summary
Mimo has expanded its intrusion operations beyond focusing solely on Craft CMS to target the Magento ecommerce platform, Docker environments, and cloud instances (specifically AWS EC2). The primary objective appears to be financial monetization through cryptojacking and bandwidth reselling (proxyjacking).
## Tactics, Techniques & Procedures
- **Initial Access:** Exploits PHP-FPM vulnerabilities in Magento. Also targets misconfigured Docker APIs to deploy malicious containers.
- **Persistence:** Establishes persistence using GSocket reverse shells.
- **Defense Evasion:** Employs advanced memory-based evasion techniques, specifically using `memfd_create()` for in-memory payload execution. Utilizes the `alamdar.so` rootkit injected via `/etc/ld.so.preload` to obfuscate processes and files.
- **Lateral Movement/Propagation:** Demonstrates self-propagation capabilities by scanning local networks and SSH configurations to spread to related hosts.
- **Tools Observed:** 4l4md4r loader and stager, alamdar.so rootkit.
## Targeting
- **Sectors:** Ecommerce (Magento), Cloud Computing (AWS EC2).
- **Geography:** Not explicitly detailed, but targeting common public-facing platforms like Magento and Docker suggests broad internet exposure.
- **Victims:** Organizations using Magento, Docker environments, and cloud instances.
## Tools & Infrastructure
- **Malware Families Used:** GSocket reverse shells, alamdar.so rootkit, 4l4md4r loader/stager.
- **Monetization Tools:** XMRig (for cryptojacking), IPRoyal Pawns client (`hezb.x86_64`, for proxyjacking).
- **Infrastructure (C2/Pools):** C3Pool Monero pool.
- **URLs/IPs (Defanged):** None explicitly detailed in the provided text snippet, other than the Monero pool name.
## Implications
Mimo represents a financially motivated threat actor utilizing recently disclosed vulnerabilities (1-day) for initial compromise. Their pivot to Magento, combined with sophisticated in-memory execution and rootkit usage, indicates a mature operator focused on maintaining long-term, stealthy resource hijacking on high-value targets like ecommerce servers and cloud resources.
## Mitigations
- Patch PHP-FPM vulnerabilities immediately, especially those affecting Magento installations.
- Harden Docker APIs and configurations to prevent the deployment of malicious containers via exposed APIs.
- Monitor for suspicious reverse shells (GSocket) and persistence mechanisms leveraging dynamic library preloading (`/etc/ld.so.preload`).
- Implement host-based intrusion detection focusing on memory anomalies and attempts to use syscalls like `memfd_create()`.
- Monitor for unauthorized XMRig processes or deployment of proxy software like IPRoyal Pawns clients.