A cryptomining and backdoor campaign was distributed through public model repositories that appeared to be small test checkpoints. The malicious code was delivered when users loaded a model with permission to run publisher-supplied code, so execution began before model weights were used. The campaign targeted self-hosted inference hosts, rented GPU machines, shared research notebooks, and continuous-integration jobs that pull small models without code review. Multiple repositories across multiple accounts recorded tens of thousands of downloads, although the figure does not confirm infections or unique victims. The risk is unauthorized code execution, persistent remote access, and GPU compute being used for mining.
The malicious repository supplies a Python module that runs when the model loader imports it, before weights load. The module starts a watchdog process, adds startup hooks so the watchdog can relaunch a missing miner, and downloads a packed cryptominer from the repository or a mirror. The miner is executed from a memory-backed file and named like a kernel worker, while a fallback copy remains for the watchdog. Packer markers are altered to block routine unpacking. Status is reported through the local inference registry using encoded model names, and rival miners are removed or killed. Later builds add reconnecting reverse shells, and a later dropper serves its second stage only to allow-listed source addresses. A container escape script can mount host disks and obtain host root.[/subscribe_to_unlock_form]
A cryptomining and backdoor campaign was distributed through public model repositories that appeared to be small test checkpoints. The malicious code was delivered when users loaded a model with permission to run publisher-supplied code, so execution began before model weights were used. The campaign targeted self-hosted inference hosts, rented GPU machines, shared research notebooks, and continuous-integration jobs that pull small models without code review. Multiple repositories across multiple accounts recorded tens of thousands of downloads, although the figure does not confirm infections or unique victims. The risk is unauthorized code execution, persistent remote access, and GPU compute being used for mining.
The malicious repository supplies a Python module that runs when the model loader imports it, before weights load. The module starts a watchdog process, adds startup hooks so the watchdog can relaunch a missing miner, and downloads a packed cryptominer from the repository or a mirror. The miner is executed from a memory-backed file and named like a kernel worker, while a fallback copy remains for the watchdog. Packer markers are altered to block routine unpacking. Status is reported through the local inference registry using encoded model names, and rival miners are removed or killed. Later builds add reconnecting reverse shells, and a later dropper serves its second stage only to allow-listed source addresses. A container escape script can mount host disks and obtain host root.[emaillocker id="1283"]
The activity appears financially motivated, with a Chinese-speaking operator or small group adapting after takedowns. The campaign spanned multiple waves and many repositories, recorded tens of thousands of downloads, and produced realized cryptocurrency earnings, while some repositories remained live after removal. The operator revised loaders, replaced planted remote-access keys with reverse shells, added access restrictions, and introduced a container escape capability. Defenders should treat model repositories as untrusted code, review the code before enabling remote-code execution, and monitor GPU hosts for unexpected processes, outbound connections, and mining activity.
| Tactic | Technique Id | Technique | Sub-technique |
|---|---|---|---|
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Execution | T1059.004 | Command and Scripting Interpreter | Python |
| Persistence | T1053.005 | Scheduled Task/Job | Scheduled Task |
| Persistence | T1547.001 | Boot or Logon Autostart Execution | Registry Run Keys |
| Defense Evasion | T1070.001 | Indicator Removal | Clear Windows Event Logs |
| Defense Evasion | T1027.002 | Obfuscated Files or Information | Software Packing |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Command and Control | T1071.001 | Application Layer Protocol | Web Protocols |
| Objective | Behavior ID | Behavior |
|---|---|---|
| Collection | B0028 | Cryptocurrency |
| Impact | B0022 | Remote Access |
| Anti-Behavioral Analysis | F0001 | Software Packing |
| Defense Evasion | E1564 | Hide Artifacts |
| Persistence | F0012 | Registry Run Keys / Startup Folder |
| Process Micro-objective | C0042 | Create Mutex |
| Communication Micro-objective | C0001 | Socket Communication |
| Process Micro-objective | C0017 | Create Process |
| File System Micro-objective | C0052 | Writes File |
| Memory Micro-objective | C0007 | Allocate Memory |
| Anti-Behavioral Analysis | B0007 | Sandbox Detection |
| Discovery | E1082 | System Information Discovery |
The following reports contain further technical details:
[/emaillocker]