Soco404 Cryptomining Campaign Targets Exposed PostgreSQL Across Linux and Windows
Summary
Wiz details Soco404, a cryptomining campaign that abuses exposed PostgreSQL, delivers Linux and Windows payloads from compromised servers, and uses fake 404 pages to conceal malware. Google Sites hosting the pages was taken down after reporting.
Key points
- Wiz says the campaign abuses exposed PostgreSQL instances, using COPY ... FROM PROGRAM for remote code execution; compromised Apache Tomcat servers host payloads.
- Linux malware uses a Go loader and disguises processes as system services; cron jobs and shell initialization files provide persistence.
- The Windows loader uses certutil, PowerShell, or curl, creates a service, attempts to stop event logging, and injects its payload into conhost.exe.
- Both platforms mine cryptocurrency and use the same wallet, according to Wiz.
- Payloads are embedded in fake 404 pages hosted on Google Sites; Wiz says it reported the sites and they were taken down.
- Wiz links some payload hosting to suspected crypto-scam infrastructure, while noting the campaign appears active based on mining-pool worker activity.
Article Details
- Attack Vectors
- The attacker targets exposed PostgreSQL instances and abuses COPY ... FROM PROGRAM to execute commands remotely; the article also notes that weak credentials may enable access.
- Payloads are delivered from compromised Apache Tomcat servers and embedded in fake 404 pages hosted on Google Sites.
- Windows payload delivery uses certutil, PowerShell, or curl as fallback download methods.
- Defensive Notes
- Identify and secure publicly exposed PostgreSQL instances, especially those with weak or default credentials.
- Monitor database processes for anomalous shell execution, payload downloads, persistence creation, and cryptomining behavior.
- The article reports that Google Sites hosting the fake error pages were reported and taken down.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | dblikes[.]cyou | Domain listed as a Soco404 payload-hosting site. |
| DOMAIN | seeyoume[.]top | Domain hosting a fake cryptocurrency exchange page that embedded a campaign shell-script payload. |
| DOMAIN | www[.]fastsoco[.]top | Payload-hosting domain contacted by the malware; the article identifies it as Soco404 infrastructure. |
| SHA256 | 0086fe6259af25f3b5a12d81080bed61938cc70ebdf480501acc1c10ac39c74a | Hash identified for the Windows os.exe malware. |
| SHA256 | 039caa15c1a54b49250717e68cd1a78a4be17b80e8062441c340eba0674e5926 | Hash identified for the ldr.sh malware loader. |
| SHA256 | 0ad013c5166900b9c57a7ff771dbbf8b11f8a3be46a85cff6ced83ceb1a38f8d | Hash identified for the ldr.sh malware loader. |
| SHA256 | 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5 | Hash identified for the WinRing0.sys driver dropped by the Windows payload. |
| SHA256 | 13e3cb74ad420c0770b9fedae617eaf312272db12035e4f64ebb606ac96f6ef0 | Hash identified for ELF malware used in the campaign. |
| SHA256 | 22abd35b6afd1909e6d71bd75b2ac23890e2675f9d40e403b0cfd4ed155a96f6 | Hash identified for ELF malware used in the campaign. |
| SHA256 | 424f15e2509ed62c95d5637df0b519c40f73b3cbb00b7a8073ba89ddad7e5dc1 | Hash identified for ELF malware used in the campaign. |
| SHA256 | 498ecdfce65d739154b39703c63c8f4334066655e1cc8024c2716e280598cacc | Hash identified for the Windows ok.exe malware loader. |
| SHA256 | 54303aa4f7b7ae3137f5f1368dba6b9b90f7826b8b18132ea495fff29f33f1e4 | Hash identified for ELF malware used in the campaign. |
| SHA256 | 5a8e5d7dfc7ccadf8b66fa8b04cf33010f0384072fc9b1fc79e7e1a65a0c701c | Hash identified for the ldr.sh malware loader. |
| SHA256 | 5b224a091151661943e038066ef03f7b5bab055187f3b1b582dbfe392e74c921 | Hash identified for the Windows appx.exe malware. |
| SHA256 | 68bb9e294ba7f1b0426e16abbdb5c8f29daa8e8d98aee7a430ead97f2ffadd3a | Hash identified for ELF malware used in the campaign. |
| SHA256 | 8739f0189f64636fab1965bb066ba67a980ecabafd4307f4fb732ffdc154fa04 | Hash identified for ELF malware used in the campaign. |
| SHA256 | 8d06979a38ee5ef6f03817a1d16ab75171528cfaf8f743bfe64b45abd6c26142 | Hash identified for the Windows ok.exe malware loader. |
| SHA256 | a047e82948bf7c43281c975b9588bf5d4500fd671a5e25fc3f9206cbd1827dfd | Hash identified for the Windows ok.exe malware loader. |
| SHA256 | bac4b166dec1df8aa823a15136c82c8b50960b11a0c4da68b8d7dedcb0f3a794 | Hash identified for the Soco404 soco.sh dropper. |
| SHA256 | bf038c13468a9b75278ea198c3d41d4ad4fc14e447d9dd0a94915ce2ab8132e5 | Hash identified for the Windows ok.exe malware loader. |
| SHA256 | c67e876d7b3ae5f3c4fd626d8ba62e77bd47dfdf51f7a4438edd64bd0f88ce3a | Hash identified for the Soco404 soco.sh dropper. |
| SHA256 | c9bb137d56fab7d52b3dbc85ae754b79d861a118bfb99566faaa342c978285ff | Hash identified for the Soco404 soco.sh dropper. |
| SHA256 | cbb9d5c601fca0b9b25ec914431abc35c45d5f4c2bbf18e14661aadd8e7e2f47 | Hash identified for ELF malware used in the campaign. |
| SHA256 | e69e55027bf64011599ae1283d15d157bfefed1c03e20fe72ecf7e90fd451e76 | Hash identified for ELF malware used in the campaign. |
| SHA256 | e7fe0a5c6c198be8941d5a1be7c0669688c45751e9bf0d16a0ae6ae1d0e7a957 | Hash identified for ELF malware used in the campaign. |
| URL | hxxps[:]//sites[.]google[.]com/view/2025soco/ | Specific Google Sites page identified as hosting the campaign's embedded payload in a fake 404 page. |
| URL | hxxps[:]//sites[.]google[.]com/view/dblikes | Specific Google Sites page listed as a Soco404 payload-hosting site. |
| URL | hxxps[:]//sites[.]google[.]com/view/osk05 | Specific Google Sites page listed as a Soco404 payload-hosting site. |
| URL | hxxps[:]//sites[.]google[.]com/view/sogoto | Specific Google Sites page listed as a Soco404 payload-hosting site. |
| URL | hxxps[:]//www[.]fastsoco[.]top/1 | Specific malware payload URL hosted on Soco404 infrastructure. |
MITRE ATT&CK
T1027.002 · Software PackingThe app2 Go binary is UPX-packed, and the Windows payload uses delayed self-deletion to reduce evidence.T1027.006 · HTML SmugglingThe fake 404 page embeds a base64-encoded binary in its HTML, delimited by exe101 markers.T1036.005 · Match Legitimate Resource Name or LocationLinux payload processes use names including sd-pam, cpuhp/1, and kworker/R-rcu_p to resemble legitimate system processes.T1053.003 · CronThe Linux payload adds a cron job that runs the malware every minute.T1055 · Process InjectionThe Windows payload injects its main payload into a conhost.exe process.T1059.004 · Unix ShellAfter PostgreSQL access, commands executed payloads through a Unix shell, including running soco.sh with bash.T1070.002 · Clear Linux or Mac System LogsThe Linux script overwrites cron, secure, and wtmp logs and the root mailbox to remove execution evidence.T1070.004 · File DeletionThe Linux dropper deletes the downloaded binary shortly after execution, and the Windows loader deletes its original executable.T1105 · Ingress Tool TransferLinux and Windows payloads were downloaded from compromised servers using utilities such as curl, wget, certutil, and PowerShell.T1110.003 · Password SprayingThe article explicitly reports this technique in its ATT&CK list, but describes scanning and weak-credential access without detailing password-spraying activity.T1190 · Exploit Public-Facing ApplicationThe attacker abused exposed PostgreSQL functionality for remote command execution; the article also describes CVE-2025-24813 as a possible entry vector to compromised Tomcat servers.T1496 · Resource HijackingThe Linux and Windows payloads mine cryptocurrency using identified mining pools and attacker wallet addresses.T1543.003 · Windows ServiceThe Windows payload creates an automatically started service with a randomly generated name.T1546.004 · Unix Shell Configuration ModificationThe malware appends commands to /etc/profile, .bashrc, and .profile for execution through shell initialization.T1562.002 · Disable Windows Event LoggingThe Windows malware attempts to stop the eventlog service.
CVE
Malware
Vendors
Products
Apache Tomcatprevious activity tied to this campaign has been documented by Aqua and Imperva as targeting exposed Apache Tomcat services with weak credentials , as well as vulnerable Apache Struts and Atlassian Confluence servers,Google SitesPayloads are embedded in fake 404 HTML pages hosted on websites built using Google Sites.PostgreSQLservers, our investigation uncovered a distinct case in which the attacker also targets exposed PostgreSQL instances and leverages compromised Apache Tomcat servers to host payloads tailored for both Linux andWinRing0.sysThe ok.exe binary functions as a loader that embeds both the main payload and the WinRing0.sys driver. Upon execution, it copies itself to C:\ProgramData\fuekghfebdot\hunyknsmqtgn.exe or C:\ProgramData\
Tools
certutilof ingress tools, including Linux utilities like wget and curl, as well as Windows-native tools such as certutil and PowerShell, highlights an opportunistic strategy. Rather than relying on a single method orcurlentry point. Their use of a wide range of ingress tools, including Linux utilities like wget and curl, as well as Windows-native tools such as certutil and PowerShell, highlights an opportunistic strategy.GarbleThe binary app2 (14bf32e780601c6870811982648cf293) is a UPX [T1027.002] packed Go binary obfuscated [T1027] using Garble to hinder analysis. Its primary function is to act as a loader for the main payload.PowerShellincluding Linux utilities like wget and curl, as well as Windows-native tools such as certutil and PowerShell, highlights an opportunistic strategy. Rather than relying on a single method or operating system, theUPXThe binary app2 (14bf32e780601c6870811982648cf293) is a UPX [T1027.002] packed Go binary obfuscated [T1027] using Garble to hinder analysis. Its primary function is to act as a loader for the main payload.wgetany accessible entry point. Their use of a wide range of ingress tools, including Linux utilities like wget and curl, as well as Windows-native tools such as certutil and PowerShell, highlights an opportunisticXMRigwith a random name to the temp directory. WinRing0.sys is a component commonly used by cryptominers like XMRig to gain low-level access to system resources and improve performance.
Industries
CryptocurrencyCrypto-Scam Websites - Domains used to host fraudulent cryptocurrency trading platforms, likely as part of a broader social engineering effort.TransportationNotably, the attacker has successfully compromised a legitimate Korean transportation website, demonstrating their ability to abuse trusted infrastructure for malicious purposes.