Diicot Campaign Targeting Linux Environments (Campaign)
ID: 4d922159-b762-5f34-b326-92c7fa50d97a
STIX ID: report--4d922159-b762-5f34-b326-92c7fa50d97a
Feed Name: Wiz Cloud Threat Landscape
Date Published: 2024-12-17
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
Wiz Research uncovered a Diicot threat-group campaign targeting Linux cloud environments that employs SSH brute-force, cloud-aware modular malware with HTTP C2 and reverse shell capabilities, and cryptomining monetization (over $16,000 in Monero). The campaign shows improved persistence, UPX header corruption for obfuscation, and active infrastructure since October 2024, indicating ongoing, adaptive operations against cloud hosts.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.