ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Home > List all groups > 8220 Gang

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Other threat group: 8220 Gang

Names8220 Gang (Talos)
8220 Mining Group (Talos)
Returned Libra (Palo Alto)
CountryChina China
MotivationFinancial gain
First seen2017
Description(Trend Micro) 8220 Gang (also known as “8220 Mining Group,” derived from their use of port 8220 for command and control or C&C communications exchange) has been active since 2017 and continues to scan for vulnerable applications in cloud and container environments. Researchers have documented this group targeting Oracle WebLogic, Apache Log4j, Atlassian Confluence vulnerabilities, and misconfigured Docker containers to deploy cryptocurrency miners in both Linux and Microsoft Windows hosts. The group was documented to have used Tsunami malware, XMRIG cryptominer, masscan, and spirit, among other tools in their campaigns.
Tools used
Operations performedMay 20218220 Gangs Recent use of Custom Miner and Botnet
Jul 20228220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts
Oct 20228220 Gang Cloud Botnet Targets Misconfigured Cloud Workloads
Nov 20228220 Gang Continues to Evolve With Each New Campaign
May 20238220 Gang Evolves With New Strategies

Last change to this card: 10 March 2024

Download this actor card in PDF or JSON format

Previous: [Unnamed groups: Russia]
Next: Achilles

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]