Soco404 Cryptomining Campaign Exploits PostgreSQL and Cloud Misconfigurations (Campaign)

Wiz Research describes the Soco404 cryptomining campaign that targets cloud environments by exploiting exposed PostgreSQL instances and vulnerable Apache Tomcat servers to deliver XMRig miners. The threat actor uses evasive techniques (in-memory execution, process masquerading, log wiping), persistence (cron jobs, shell injections, Windows services), and hides payloads in fake Google Sites 404 pages; infrastructure is also linked to fraudulent crypto trading sites.