Soco404: Multiplatform Cryptomining Campaign Uses Fake Error Pages to Hide Payload

Wiz Research has identified a new iteration of a broader malicious cryptomining campaign, which we’ve dubbed Soco404.

Wiz research has observed an active campaign exploiting various vulnerabilities and misconfigurations across cloud environments to deploy cryptominers.

In the variant described in the blog, the attacker exploited misconfigurations in PostgresSQL.

The attacker targets bothLinuxandWindowssystems, deploying platform-specific malware.

They use process masquerading to disguise malicious activity as legitimate system processes.

They achieve persistence via cron job and shell initialization files (e.g.,.bashrc,.profile).

They rely on compromised legitimate servers to host and deliver malware.

The malware spawns multiple child processes that communicate via local sockets.

Payloads are embedded in fake 404 HTML pages hosted on websites built usingGoogle Sites.Note: We reported these sites to Google, and they have since been taken down.

We estimate that this campaign is part of a broader crypto-scam infrastructure.

Wiz Research has identified a new iteration of a broader malicious cryptomining campaign, which we’ve dubbedSoco404(based on the observed payload name, associated domain, and use of fake error pages). While previous activity tied to this campaign has been documented by Aqua and Imperva as targeting exposedApache Tomcatservices with weak credentials , as well as vulnerableApache Struts and Atlassian Confluenceservers, our investigation uncovered a distinct case in which the attacker also targets exposed PostgreSQL instances and leverages compromised Apache Tomcat servers to host payloads tailored for both Linux and Windows environments. We also found evidence that the attacker is maintaining a broader crypto-scam infrastructure, further suggesting this is part of a long-term, versatile, and opportunistic operation.

The threat actor behindSoco404has leveraged multiple types of infrastructure, which we have grouped into three distinct clusters:

Fake 404 Domains- Registered domains that display fake 404 error pages while embedding malicious payloads directly within the HTML content.

Crypto-Scam Websites- Domains used to host fraudulent cryptocurrency trading platforms, likely as part of a broader social engineering effort.

Compromised Infrastructure- Legitimate servers compromised via vulnerable Apache Tomcat instances, used to host and distribute malware payloads. Notably, the attacker has successfully compromised a legitimate Korean transportation website, demonstrating their ability to abuse trusted infrastructure for malicious purposes.

As mentioned in our previousblog post on PostgreSQL cryptojacking,our data shows that nearly 90% of cloud environments self-host PostgreSQL instances, and one-third of those have at least one instance publicly exposed to the internet. These exposed PostgreSQL servers are frequently targeted by threat actors, making them a high-risk attack surface.

In this writeup, we detail the Soco404 campaign, share IoCs, and provide insight into its ongoing activity. Based on the dynamic number of workers linked to the attacker’s crypto wallet within the mining pool, the campaign appears to still be active.

Threat actors are actively scanning for accessible services [T1110.003] that allow unauthenticated or low-effort entry points, with PostgreSQL frequently appearing in attack flows due to its prevalence and default configurations. Upon gaining access, attackers abuse PostgreSQL’sCOPY ... FROM PROGRAMfunctionality to achieve remote code execution [T1190], enabling them to retrieve and execute malicious payloads directly on the host  [T1059.004].

The attacker behindSoco404appears to be conducting automated scans for exposed services, aiming to exploit any accessible entry point. Their use of a wide range of ingress tools, including Linux utilities likewgetandcurl, as well as Windows-native tools such ascertutilandPowerShell, highlights an opportunistic strategy. Rather than relying on a single method or operating system, the attacker casts a wide net, deploying whichever tool or technique is available in the environment to deliver their payload. This flexible approach is characteristic of a broad, automated cryptomining campaign focused on maximizing reach and persistence across varied targets.

In the following sections we will detail both Linux and Windows payloads.

Upon successful exploitation the attacker runs the soco.sh script directly in memory, avoiding disk writes.

soco.shis a dropper script that is in charge of setting the ground for the main payload. Key points:

1.Download & execute payload fromhttp://<compromised-service>:8080/app2[T1105]. The script generates a random filename based on the timestamp and drops it into a writable directory on disk, explicitly avoiding/tmpand/sys, likely for persistence or evasion purposes. Next, the script will run the sleep command for 2 seconds and then delete the binary from disk to minimize its footprint [T1070.004]. The server hosting the payload is a compromised [T1584.004], publicly accessible Apache Tomcat instance. Based on Aqua’s findings, it is likely that the attacker gained access via weak credentials, though exploitation of theCVE-2025-24813vulnerability [T1190] is also a possible entry vector given the versions in use.

In the following section, we detail the behavior of the downloaded payload.

2. Eliminate potential competing miners by clearing/etc/ld.so.preload, remove suspicious cron jobs, and forcefully killing processes with separate mount namespaces.

3. Remove evidence of execution and reduce forensic visibility by overwriting logs including cron and wtmp [T1070.002]:

4. If the script is running as root, it will attempt to optimize memory performance and Maximize CPU efficiency for cryptomining.

*See fullsoco.shscript in Archive section below.

The binaryapp2(14bf32e780601c6870811982648cf293) is a UPX [T1027.002] packed Go binary obfuscated  [T1027] usingGarbleto hinder analysis. Its primary function is to act as a loader for the main payload.

Upon execution, the malware unpacks itself into memory and spawns multiple child processes. One of these processes is responsible for re-executing the binary under the name (sd-pam), in an attempt to masquerade [T1036.005] as the legitimate systemd user service that handlesPAM (Pluggable Authentication Modules)sessions on Linux systems.

After this, it reaches out to the command-and-control (C2) server athttps[:]//www[.]fastsoco[.]top, which hosts the main payload athttps[:]//www[.]fastsoco[.]top/1.

This website is based onGoogle Sites(https[:]//sites[.]google[.]com/view/2025soco/), which, when accessed, displays a fake 404 error page [T1583.006]. The actual binary is embedded within the HTML content [T1027.006] as a base64-encoded blob, which is extracted by searching for content between the markersexe101andexe101.

The main payload is executed with the names[cpuhp/1]and[kworker/R-rcu_p]to masquerade as kernel related processes [T1036.005].

It establishes the following persistence:

1.Crontab

A new cron job is added to run the malware every minute [T1053.003]:

2. Shell initialization files

The following command is appended to/etc/profile,.bashrc, and.profile[T1546.004]:

During execution, the malware creates multiple forked processes and drops additional copies of itself to disk using randomly generated filenames. These processes interact with each other via local socket communication [T1559], likely to coordinate functionality or monitor each other for resilience.

Once established, it begins cryptocurrency mining  [T1496] by connecting to the poolsc3poolandmoneroocean, using the following wallet address:

The Windows initial post exploitation command is designed to download and execute a Windows binary (ok.exe) from the compromised server using multiple fallback methods to maximize the chances of successful execution. It begins by invokingcertutil, a legitimate Windows utility originally intended for managing certificates, which also includes functionality for downloading files from URLs. Attackers frequently abusecertutilbecause it is built-in, commonly allowed by endpoint defenses, and can fetch and save remote payloads without raising immediate suspicion. If certutil fails or is blocked, the command falls back to using PowerShell’sInvoke-WebRequest, and finally tocurl[T1105], each attempting to download the file toC:\Users\Public\directory, a universally writable path, and execute it.

Theok.exebinary functions as a loader that embeds both the main payload and the WinRing0.sys driver. Upon execution, it copies itself toC:\ProgramData\fuekghfebdot\hunyknsmqtgn.exe or C:\ProgramData\ blbsihkzkqxm\wytourcabiik.exeand establishes persistence by creating a service [T1543.003] with a random 8-character uppercase alphabetical name:

It then attempts to cover its tracks by stopping the Windows event log service [T1562.002]:

To remove evidence of the original binary, the malware executes a self-deletion command [T1027.002]. It uses thechoicecommand to introduce a 3-second delay before deleting the file.

Afterward, it spawns aconhost.exeprocess and injects the main payload into it, [T1055], creating multiple threads that communicate via TCP sockets [T1559]. It also drops theWinRing0.sysdriver with a random name to the temp directory.WinRing0.sysis a component commonly used by cryptominers like XMRig to gain low-level access to system resources and improve performance.

The malware ultimately begins mining cryptocurrency  [T1496] using the same wallet that was used by the Linux payload.

During our analysis, we identified that one of the attacker’s payloads was hosted on afake cryptocurrency exchange website,seeyoume[.]top, which claimed affiliation with theHong Kong Stock Exchange (HKEX). When accessingseeyoume[.]top/sol, we received a fake 404 error page that embedded the same shell script seen in the previously documented instances of the campaign.

Further investigation into the domain led us to aRussian scam alert website, which linkedseeyoume[.]topto a broader crypto-scam operation and detailed the scam’s workflow. The alert also referenced additional domains associated with the scam;

arcticoins[.]com

diamondcapitalcrypro[.]com

nordicicoins[.]com

hkcapitals[.]com

diamondcapitalcrypro[.]comwas still live and hosted nearly identical fake crypto exchange website, reinforcing the likelihood of a coordinated scam infrastructure.

The Wiz Dynamic Scanner detects publicly exposed PostgreSQL services configured with weak or default credentials within customers' cloud environments. The Wiz agentless workload scanner detects containers and VMs hosting PostgreSQL and identifies if they contain sensitive data or have access to highly privileged service accounts (which could just as easily be abused by opportunistic attackers for purposes other than cryptojacking).

TheWiz Runtime Sensordetects events and behaviors associated with this threat and similar ones, alerting you as the adversary progresses through the attack kill chain: from the exploit to the initial payload delivery, persistence creations and ultimately to the final cryptomining activity.

Below is an example of the initial access vector identified by the detection 'Anomalous shell execution by a database process':

soco.shscript:

Command and Control - Ingress Tool Transfer (T1105)

Credential Access - Brute Force: Password Spraying (T1110.003)

Defense Evasion - Impair Defenses: Disable Windows Event Logging (T1562.002)

Defense Evasion - Indicator Removal: Clear Linux or Mac System Logs (T1070.002)

Defense Evasion - Indicator Removal: File Deletion (T1070.004)

Defense Evasion - Masquerading: Match Legitimate Name or Location (T1036.005)

Defense Evasion - Obfuscated Files or Information (T1027.002)

Defense Evasion - Obfuscated Files or Information: HTML Smuggling (T1027.006)

Defense Evasion - Obfuscated Files or Information: Software Packing (T1027.002)

Defense Evasion - Process Injection (T1055)

Execution - Command and Scripting Interpreter: Unix Shell (T1059.004)

Execution - Inter-Process Communication (T1559)

Initial Access - Exploit Public-Facing Application (T1190)

Impact – Resource Hijacking (T1496)

Persistence - Create or Modify System Process: Windows Service (T1543.003)

Persistence - Scheduled Task/Job: Cron (T1053.003)

Persistence - Event Triggered Execution: Unix Shell Configuration Modification (T1546.004)

Resource Development - Acquire Infrastructure: Web Services (T1583.006)

Resource Development - Compromise Infrastructure: Server (T1584.004)

Detect and mitigate CVE-2025-53770 and CVE-2025-53771 - critical vulnerabilities in Microsoft SharePoint Server currently under active exploitation.

New critical vulnerability with 9.0 CVSS presents systemic risk to the AI ecosystem, carries widespread implications for AI infrastructure.

Improve security posture and remediate risks faster using natural language workflows.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings