Water Sigbin
Also known as 8220 Gang
The 8220 Gang, also known as Water Sigbin, is a threat actor group that focuses on deploying cryptocurrency-mining malware. They exploit vulnerabilities in Oracle WebLogic servers, such as CVE-2017-3506 and CVE-2023-21839, to deliver cryptocurrency miners using PowerShell scripts. The group has demonstrated a sophisticated multistage loading technique to deploy the PureCrypter loader and XMRIG crypto miner. They are known for using obfuscation techniques, such as hexadecimal encoding and code obfuscation, to evade detection and compromise systems.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html
- https://www.trendmicro.com/en_us/research/24/e/decoding-8220-latest-obfuscation-tricks.html
- https://www.uptycs.com/blog/8220-gang-cryptomining-cloud-based-infrastructure-cyber-threat
- https://www.imperva.com/blog/imperva-detects-undocumented-8220-gang-activities/
- https://asec.ahnlab.com/en/51568/
- https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html
- https://blog.aquasec.com/8220-gang-confluence-vulnerability-cve-2022-26134
- https://www.sentinelone.com/blog/from-the-front-lines-8220-gang-massively-expands-cloud-botnet-to-30000-infected-hosts/
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.