Mimo Exploits Magento CMS to Steal Card Information and Monetize Bandwidth

The threat actor known as Mimo (aka “Mimo’lette”, possibly affiliated with the Hezb group), previously notorious for targeting the Craft CMS, has expanded operations to target Magento e-commerce platforms.

The latest campaign leverages a suspected PHP-FPM vulnerability to gain initial foothold and deploys a suite of advanced persistence, evasion, and monetization techniques.

Over a multi-day observation, security researchers traced Mimo as they compromised Magento instances via a PHP-FPM command injection, likely executed through a vulnerable plugin.

This marks a major platform pivot and showcases the group’s growing proficiency: their exploit arsenal now extends far beyond their original CMS targets, indicating a broadening scope and intent.

Underground Revenue Strategies

Upon gaining access, Mimo quickly moves to establish resilient backdoor connections by deploying the GSocket utility ordinarily a legitimate pentesting tool, but here adapted for stealthy command and control (C2).

GSocket enables Mimo to circumvent firewalls and NAT, provides traffic encryption, can route via TOR, and offers self-restarting daemonized shells that are particularly tricky to eradicate.

Persistence is reinforced through systemd unit files, legacy system startup scripts, and crontab modifications, while the malicious GSocket process is camouflaged with plausible kernel thread names like [kswapd0] or [mm_percpu_wq] to further evade detection.

Elevating their stealth, Mimo employs a memory-based loader using the memfd_create() syscall, generating ephemeral in-memory executables that never touch disk.

These payloads, often masquerading as kernel memory objects (e.g., memfd:[rcu_sched]), load additional malware and rootkits entirely in RAM, outmaneuvering many endpoint security solutions.

Complementing this, the installation of a rootkit (alamdar.so) via /etc/ld.so.preload ensures critical process and file activity is removed from administrator view, doubling down on concealment.

Notably, Mimo methodically wipes pre-existing persistence artifacts and reloads its own stubs to ensure exclusivity of access.

SSH keys and configurations are looted to enable brute-force lateral movement, with the malware seeking out additional hosts (including AWS EC2 instances) through noisy automated scanning.

Cryptojacking and Proxyjacking

The group maximizes returns from every victim by profit stacking: deploying a customized, obfuscated XMRig rigged for Monero mining with the C3Pool, alongside the IPRoyal Pawns client (hezb.x86_64) to enroll victims’ servers into commercial residential-proxy networks a combination affording both CPU and bandwidth profit streams.

This duo allows continued illicit income even if one component (such as the cryptominer) is detected and remediated, as proxyware typically operates below the radar. Crucially, the campaign is not limited to Magento.

Researchers observed similar tactics targeting Docker engines left exposed to the Internet. Here, Mimo abuses the Docker API to deploy containers via malicious bootstrap scripts, following with ELF binaries built in Go and obfuscated via UPX.

The binaries feature modular code for persistence, process killing, file injection, SSH brute forcing, and memfd-based execution all tightly orchestrated for resilience and propagation.

To mitigate Mimo intrusions, experts recommend auditing /etc/ld.so.preload, monitoring for stealthy cron jobs (especially those invoking GSocket or obfuscated payloads), updating CMS software, blocking known IoCs and outbound connections typical for Monero mining, and investigating for orphaned binaries and suspicious persistence artifacts in locations like /tmp and /dev/shm.

Compromised hosts must be cleansed thoroughly, with credentials rotated and logs reviewed for further compromise.

Mimo’s evolving tactics ranging from in-memory execution, advanced rootkitting, to multi-tier C2 and bandwidth monetization represent a dire escalation in threat sophistication facing unpatched e-commerce and cloud systems.

Indicators of Compromise (IoC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.