APT Explorer

All actors

Returned Libra

Also reported as 8220 Gang, 8220 Mining Group and Water Sigbin. Linked to China by three sources.

Reports
18
Last reported
Known CVEs
14
Origin
China
ID
returned-libra
Sources
MISPETDAMalpedia
Merge evidence
8 alias matches

Reports per quarter

Dated reports, 2022 Q1 to 2026 Q2.

CVEs named in reports

Show all 14 CVEs Show fewer

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

  1. The 8220 Gang: Targeting Cloud Providers and Vulnerable Applications

    date ORKL added it ORKL

    Archived copy on ORKL Details

  2. 8220 Gang Continues to Evolve With Each New Campaign

    date ORKL added it ORKL

    Archived copy on ORKL Details

  3. 8220 Gang Cloud Botnet Targets Misconfigured Cloud Workloads

    date ORKL added it ORKL

    Archived copy on ORKL Details

  4. Mimo CoinMiner and Mimus Ransomware Installed via Vulnerability Attacks - ASEC

    date ORKL added it ORKL

    Archived copy on ORKL Details

  5. RedLine Stealer Malware Deployed Via ScrubCrypt Evasion Tool

    date ORKL added it ORKL

    Archived copy on ORKL Details

  6. Connecting the dots between recently active cryptominers

    date ORKL added it ORKL

    Archived copy on ORKL Details

  7. Investigating Monero Coin Miner

    date ORKL added it ORKL

    Archived copy on ORKL Details

  8. Examining Water Sigbin's Infection Routine Leading to an XMRig Cryptominer

    Malpedia library date ORKL

    Archived copy on ORKL Details

  9. Decoding Water Sigbin's Latest Obfuscation Tricks

    Malpedia library date ORKL

    Archived copy on ORKL Details

  10. 8220 Gang Cyber Threats: Cloud Infrastructure & Cryptomining Tactics

    Malpedia library date ORKL

    Archived copy on ORKL Details

Show all 18 reports Show fewer

  1. Imperva Detects Undocumented 8220 Gang Activities | Imperva

    Malpedia library date ORKL

    Archived copy on ORKL Details

  2. Picus Cyber Threat Intelligence Report May 2023: Top 10 MITRE ATT&CK Techniques

    Malpedia library date ORKL

    Archived copy on ORKL Details

  3. 8220 Gang Evolves With New Strategies

    Malpedia library date ORKL

    Archived copy on ORKL Details

  4. 8220 Gang Uses Log4Shell Vulnerability to Install CoinMiner - ASEC

    Malpedia library date ORKL

    Archived copy on ORKL Details

  5. From the Front Lines | 8220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts

    Malpedia library date ORKL

    Archived copy on ORKL Details

  6. From the Front Lines - 8220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

  7. 8220 Gang Deploys a New Campaign with Upgraded Techniques

    Malpedia library date ORKL

    Archived copy on ORKL Details

  8. Investigating a Monero Coin Miner

    date in the title ORKL

    The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Details

Newest first. Details opens the report in Explore.