Meson Network cryptojacking campaign (Campaign)
ID: 0b66774f-298f-5ac6-8c63-48f80d6f85fe
STIX ID: report--0b66774f-298f-5ac6-8c63-48f80d6f85fe
Feed Name: Wiz Cloud Threat Landscape
Date Published: 2024-03-11
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
Researchers uncovered a cryptojacking campaign abusing a compromised cloud account to deploy almost 6,000 EC2 instances running the Meson CDN binary. The attackers exploited CVE-2021-3129 and a WordPress misconfiguration to escalate privileges and monetize bandwidth/storage via Meson Network tokens, creating significant potential cloud-cost impact; discovery was via a targeted honeypot with no public evidence of real victims as of March 12, 2024.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.