Mimo CoinMiner and Mimus Ransomware Installed via Vulnerability Attacks

**Executive summary:** ASEC observed the Mimo (Hezb) threat actor actively exploiting multiple known RCE vulnerabilities across widely used services (Log4Shell, Confluence, WSO2, PaperCut, ActiveMQ) to install XMRig coinminers, Mimus ransomware (based on MauriCrypt), proxyware, and an NHAS reverse SSH backdoor; the report provides detailed TTPs, IoCs (download URLs, MD5s, wallet/C2 addresses, email), detection names, and remediation guidance to patch vulnerable services and block infections.