Cybercrime Surge: Mimo Targets Magento & Docker in Sophisticated New Attacks

Cyber Threat Landscape Heats Up Again

In a shocking escalation of cybercriminal activity, the notorious hacking group known as Mimo (also known as Hezb) has expanded its operations far beyond its previous targets. After a notorious run exploiting Craft CMS vulnerabilities, Mimo is now actively infiltrating Magento CMS and misconfigured Docker instances, adopting stealthier and more aggressive techniques.

With a financial motivation fueled by cryptocurrency mining and illicit bandwidth monetization, Mimo is deploying advanced multi-layered attacks that combine cryptojacking, rootkits, stealthy proxyware, and brute-force lateral movement. The tactics suggest a pivot toward even more lucrative criminal ventures, raising red flags across the cybersecurity world.

Mimo’s Evolving Attack Strategy

Mimo, a persistent threat actor notorious for abusing N-day vulnerabilities, has now set its sights on Magento CMS and exposed Docker environments. Previously observed exploiting CVE-2025-32432 in Craft CMS, Mimo used this flaw to run cryptominers and proxyware. But recent campaigns showcase far more sophisticated moves.

Security experts from Datadog Security Labs have tracked new attack chains initiated via PHP-FPM command injection in Magento plugins. Once inside, the attackers deploy GSocket, a legitimate open-source tool often used for penetration testing. But in Mimo’s hands, GSocket acts as a reverse shell for persistent access.

To evade detection, GSocket camouflages itself as a system or kernel-managed thread, making it nearly invisible. The attackers also avoid writing payloads to disk, opting instead for in-memory execution via memfd_create() — a method that keeps forensic traces to a minimum.

The “4l4md4r” ELF binary loader is used to deploy XMRig (for cryptocurrency mining) and IPRoyal proxyware (to monetize bandwidth). Before this, the attackers modify system files like /etc/ld.so.preload to inject a rootkit, further hiding malicious components from system administrators and detection tools.

This dual monetization strategy is both clever and insidious. Even if a system admin detects and removes the miner, the lightweight proxyware may continue operating silently, generating revenue undetected.

Beyond CMS platforms, Mimo is also targeting publicly exposed Docker instances. They deploy containers running malware written in Go, designed for persistence, file access, process manipulation, and more. These containers also drop GSocket and IPRoyal, and attempt to spread laterally via SSH brute-force attacks.

The approach reveals Mimo’s ambition to exploit not just CMS platforms but any poorly secured or misconfigured infrastructure, underlining a widening threat surface that puts countless web services and corporate systems at risk.

🔍 What Undercode Say:

Advanced Threat Actors Are Doubling Down

Undercode analysts see Mimo’s evolution as part of a larger trend in the cybercrime ecosystem. The transition from basic exploit chains to stealthy, persistent malware deployments signals a deliberate shift from quick wins to long-term financial gains.

The use of modular malware written in Go aligns with current underground trends, where attackers seek cross-platform compatibility and high customization. These payloads are flexible, difficult to detect, and easily updated — making them ideal for long-term deployment.

Mimo’s dual exploitation of CPU (cryptomining) and network bandwidth (proxyware) shows an understanding of diversified income streams. Unlike traditional malware that relies on one function, Mimo’s setup ensures continued profits even if one part of the operation is taken down.

The PHP-FPM command injection vector in Magento is especially concerning, since many Magento installations are outdated and poorly maintained. Attackers can gain access quickly, drop their payloads, and vanish — with the victims often none the wiser.

Similarly, the Docker targeting campaign reflects a broader industry oversight. Many developers and sysadmins unintentionally expose Docker to the internet without proper isolation or authentication, effectively leaving a backdoor wide open.

GSocket’s use as a reverse shell is cunning. Because it’s a legitimate tool, traditional endpoint solutions may ignore it unless it’s explicitly blacklisted. Combined with rootkits and in-memory loaders, Mimo’s strategy allows it to embed deeply within systems, avoiding detection for weeks or months.

Their SSH brute-force component also suggests Mimo is actively attempting to expand its botnet, turning compromised machines into staging points for more attacks. This behavior could indicate preparation for ransomware deployment, data theft, or targeted DDoS campaigns.

For businesses and organizations using Magento, Docker, or Craft CMS, the time to act is now. Ensure all systems are up to date, Docker interfaces are secured, and runtime security tools are deployed to detect in-memory execution, abnormal network activity, and unauthorized system file changes.

✅ Fact Checker Results:

✅ Mimo is a known threat actor with a history of cryptojacking and proxyware deployment
✅ Recent campaigns include exploits against Magento CMS and Docker environments
✅ The group uses advanced techniques such as in-memory execution, rootkits, and SSH propagation

🔮 Prediction:

Mimo is unlikely to stop at cryptojacking or bandwidth theft. Their pivot to more stealthy, modular malware and interest in lateral movement across systems suggests ransomware or data extortion may be on the horizon. Expect this group to target enterprise systems, exploit zero-days or unpatched vulnerabilities, and evolve into a high-impact cybercrime gang if not disrupted.