Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Water Sigbin · Unknown · assessed origin China · misp-galaxy · refreshed 2026-10-06

Water Sigbin

  • 8220 Gang

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. —todaynew CVE6 new CVEs: CVE-2017-3506, CVE-2019-2725, CVE-2021-26084, CVE-2021-44228, CVE-2022-26134, CVE-2023-21839

Analyst brief

misp-galaxy

The 8220 Gang, also known as Water Sigbin, is a threat actor group that focuses on deploying cryptocurrency-mining malware. They exploit vulnerabilities in Oracle WebLogic servers, such as CVE-2017-3506 and CVE-2023-21839, to deliver cryptocurrency miners using PowerShell scripts. The group has demonstrated a sophisticated multistage loading technique to deploy the PureCrypter loader and XMRIG crypto miner. They are known for using obfuscation techniques, such as hexadecimal encoding and code obfuscation, to evade detection and compromise systems.

CVEs Water Sigbin is cited as exploiting

none on KEV
  1. CVE-2021-260842026-10-17
    1. “CVE-2021-26084 – Atlassian Confluence Server OGNL Injection RCE”

      cited as exploiting · named nearby · source: imperva.com ↗ · 2026-10-17

  2. CVE-2019-27252026-10-17
    1. “CVE-2019-2725 – Oracle WebLogic Server Authenticated Deserialization”

      cited as exploiting · named nearby · source: imperva.com ↗ · 2026-10-17

  3. CVE-2022-261342026-10-17
    1. “A recent campaign by the 8220 gang, who have been known to exploit the newly discovered critical Confluence vulnerability (CVE-2022-26134), targeted one of our honeypots.”

      cited as exploiting · source: blog.aquasec.com ↗ · 2026-10-17

    2. “CVE-2022-26134 – Atlassian Confluence Server RCE”

      cited as exploiting · named nearby · source: imperva.com ↗ · 2026-10-17

    3. “Through a meticulously orchestrated operation, the group has been exploiting well-known vulnerabilities, including CVE-2021-44228 and CVE-2022-26134, underscoring a persistent threat to cloud environments worldwide.”

      cited as exploiting · named nearby · source: uptycs.com ↗ · 2026-10-17

  4. CVE-2017-35062026-10-17
    1. “Water Sigbin continues to exploit CVE-2017-3506 and CVE-2023-21839 to deploy cryptocurrency miners via a PowerShell script.”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

    2. “In addition, the 8220 Gang has been found to cunningly use HTTP requests for malicious purposes, most notably exploiting the Oracle WebLogic vulnerability CVE-2017-3506 [2].”

      cited as exploiting · source: picussecurity.com ↗ · 2026-10-17

    3. “We observed the threat actor group known as “8220 Gang” employing new strategies for their respective campaigns, including exploits for the Linux utility “lwp-download” and CVE-2017-3506, an Oracle WebLogic vulnerability.”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

    4. “Water Sigbin exploited the vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner via a PowerShell script.”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

  5. CVE-2023-218392026-10-17
    1. “Water Sigbin continues to exploit CVE-2017-3506 and CVE-2023-21839 to deploy cryptocurrency miners via a PowerShell script.”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

    2. “Water Sigbin exploited the vulnerabilities CVE-2017-3506 and CVE-2023-21839 to deploy a cryptocurrency miner via a PowerShell script.”

      cited as exploiting · source: trendmicro.com ↗ · 2026-10-17

  6. CVE-2021-442282026-10-17
    1. “Through a meticulously orchestrated operation, the group has been exploiting well-known vulnerabilities, including CVE-2021-44228 and CVE-2022-26134, underscoring a persistent threat to cloud environments worldwide.”

      cited as exploiting · named nearby · source: uptycs.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

8 sources
  1. 1.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html
  2. 2.trendmicro.com/en_us/research/24/e/decoding-8220-latest-obfuscation-t…
  3. 3.uptycs.com/blog/8220-gang-cryptomining-cloud-based-infrastructure…
  4. 4.imperva.com/blog/imperva-detects-undocumented-8220-gang-activities
  5. 5.asec.ahnlab.com/en/51568
  6. 6.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies…
  7. 7.blog.aquasec.com/8220-gang-confluence-vulnerability-cve-2022-26134
  8. 8.sentinelone.com/blog/from-the-front-lines-8220-gang-massively-expands-…

Track Water Sigbin on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.