ThreatFox IOC Database

d351d3r

Cryptomining campaign exploiting CVE-2026-60004 (Gitea diffpatch RCE, CVSS 9.8, CISA KEV 2026-08-25). A file committed at path hooks/post-index-change executes when the diffpatch API is called twice with an identical patch: the add/add collision makes git fall back to a three-way merge and write the indexed path into the active hooks directory. The hook runs curl | sh and installs XMRig 6.26.0. Command output is written back as a git blob to refs/heads/rce-proof and retrieved via the raw file API, giving an exfiltration channel. Obfuscation: octal escapes via printf %b, then base64, then gzip, then sh; one binary additionally UPX packed. The dropper holds five delivery blocks, each pairing a different working directory with a different staging host, so losing one host does not stop delivery. NOTE 1: the first-stage dropper hash is NOT stable, the outer variable name is randomised per response. NOTE 2: the miner filename is randomised per run, pattern XX plus six characters, so name-based detection fails. Observed first-hand on a compromised host, 3 to 27 August 2026.