Hackers Leverage Craft CMS Flaw to Deploy Cryptocurrency Mining Malware

A sophisticated threat campaign has emerged, targeting Craft Content Management System (CMS) instances through a critical remote code execution (RCE) vulnerability, CVE-2025-32432.

Security researchers have observed the exploitation of this flaw in the wild since late February 2025, culminating in the deployment of advanced malware aimed at both cryptomining and monetizing network resources.

Vulnerability Overview

CVE-2025-32432 was disclosed in April 2025 and immediately attracted adversaries due to its unauthenticated RCE vector, earning a maximum CVSS score of 10.

This bug affects Craft CMS releases from 3.0.0-RC1 up to but not including 3.9.15, from 4.0.0-RC1 up to 4.14.15, and from 5.0.0-RC1 up to 5.6.17. Public exploit code surfaced quickly following disclosure, accelerating attacker uptake.

Attackers initiate their campaign by using specifically crafted HTTP requests to deploy a PHP webshell on the compromised server.

This is achieved by injecting code via GET and POST requests that manipulate session files and exploit a deserialization vector, thereby enabling unrestricted remote command execution.

Once established, the webshell fetches a remote shell script (“4l4md4r.sh”) from attacker infrastructure, using common utilities (curl, wget, or python) to guarantee execution regardless of system configuration.

The infection script is highly modular, performing environmental checks, cleaning up traces of previous infections, removing competing cryptominers, and identifying writable/executable directories for payload deployment.

Payload Deployment

The attack culminates in the deployment of a GO-based loader (the “alamdar” binary, packed with UPX), which executes with or without elevated privileges.

This loader drops two primary payloads:

1. XMRig Miner – An embedded, self-configuring Monero miner designed to run covertly, with process hiding facilitated by a malicious shared object (alamdar.so) loaded via /etc/ld.so.preload. The configuration hardcodes the attacker’s Monero wallet, mining pool, and worker details.
2. IPRoyal Pawns Proxyware – This binary (hezb.x86_64) conscripts the server into a residential proxy network, selling compromised bandwidth for attacker profit. Authentication to the service leverages credentials controlled by the threat actor.

The loader manipulates system startup and dynamic linker processes to conceal its components and maintain persistence.

The associated infection chain is notable for its efficiency, neutralising both system defences and rival malware before payload deployment.

Attribution links this campaign to the “Mimo/Hezb” intrusion set, active since at least 2022 and previously associated with both cryptomining and ransomware operations (notably a Go-based ransomware dubbed “Minus Ransomware”).

Sekoia analysis of blockchain activity indicates that the group’s primary Monero wallet has accrued over 11 XMR (~$3,100 USD), while observed ransomware activity yielded over 0.37 BTC (~$35,300 USD).

Operational patterns reveal the threat actors’ intent to maximise monetization through multi-vector resource abuse, extracting value from both CPU cycles (cryptomining) and network bandwidth (proxyware).

The campaign demonstrates agility, adopting exploits for new vulnerabilities within days of public release.

Distinctive digital fingerprints, including recurring aliases (“EtxArny”, “N1tr0”), specific process and file nomenclature (“alamdar”, “hezb”), and recurring infrastructure, provide detection opportunities for defenders.

Indicators of Compromise (IoC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.