A financially motivated threat actor known as Mimo has been actively exploiting CVE-2025-32432, a critical remote code execution vulnerability in Craft CMS. The flaw, patched in versions 3.9.15, 4.14.15, and 5.6.17, was first disclosed by Orange Cyberdefense SensePost in April 2025 after being observed in attacks earlier in February.

According to Sekoia researchers, the attackers leverage this vulnerability to gain unauthorized system access and deploy a web shell for persistent remote control. The attack chain begins with the web shell downloading and executing a shell script named “4l4md4r.sh” using curl, wget, or Python’s urllib2 library.

“The attacker imports the urllib2 library under the alias fbi, possibly a tongue-in-cheek reference to the federal agency,” noted researchers Jeremy Scion and Pierre Le Bourhis. “This distinctive naming convention could serve as a useful detection indicator during threat hunting activities.”

The shell script performs several key functions:
– Checks for previous infection indicators
– Uninstalls existing cryptocurrency miners
– Terminates active XMRig processes and competing mining tools
– Delivers additional payloads
– Launches an ELF binary called “4l4md4r”

This Mimo Loader executable modifies the “/etc/ld.so.preload” file to conceal the malware process (“alamdar.so”). The ultimate objective is deploying both IPRoyal proxyware and XMRig miner on compromised systems, enabling the threat actor to:
1. Abuse system resources for unauthorized cryptocurrency mining (cryptojacking)
2. Monetize victims’ internet bandwidth for other malicious activities (proxyjacking)

Active since March 2022, Mimo has previously exploited vulnerabilities in Apache Log4j, Atlassian Confluence, PaperCut, and Apache ActiveMQ. According to AhnLab, the group has also conducted ransomware attacks using a Go-based strain called Mimus, a fork of the open-source MauriCrypt project.

Sekoia traced the exploitation attempts to a Turkish IP address (85.106.113.168) and found evidence suggesting the threat actor is physically located in Turkey. The researchers noted, “The short timeframe between the vulnerability disclosure, PoC release, and its exploitation demonstrates Mimo’s high level of responsiveness and technical agility.”