Mimo Exploits Craft CMS RCE to Deploy Cryptominer and Proxyware in Coordinated Campaign (Campaign)

Between February and May 2025 the Mimo intrusion set actively exploited CVE-2025-32432 in Craft CMS to inject a PHP webshell and trigger a multi-stage infection that deployed a Go loader, XMRig cryptominer and IPRoyal residential proxyware; operators used LD_PRELOAD hijacking (alamdar.so), process-killing to remove competitors, and left multiple IOCs and attribution clues tying activity to Mimo and potential Ottoman/Turkish-linked operators, with financial motives and ties to Minus ransomware.