Soco404: Multiplatform Cryptomining Campaign Uses Fake Error Pages to Hide Payload

Wiz Research documents an active, opportunistic cryptomining campaign named Soco404 that scans and exploits exposed PostgreSQL and vulnerable/compromised Apache Tomcat servers to deliver cross-platform mining payloads; attackers use HTML-smuggled base64 binaries on fake 404 pages, process masquerading, persistence via cron/shell startup and Windows services, log clearing, and mining pools to monetize compromised hosts, and the report provides IoCs and detection/prevention recommendations.