🇨🇳

Water Sigbin

APT Group ETDA ✓

Also Known As 1 names

8220 Gang

Target Countries 5

Countries highlighted in red

Colombia Spain Mexico United States South Africa

Sectors Targeted

Telecommunications 517 Information 51 Computer Systems Design Services 541512 Computer Systems Design and Related Services 5415 Health Care and Social Assistance 62 Finance and Insurance 52

Details

Origin 🇨🇳 CN

Last Updated 16 Jun 2025

MITRE ATT&CK 5

T1059.004 T1071.001 T1110.001 T1203 T1496

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 4 entries

8220 Gang Talos

8220 Mining Group Talos

Returned Libra Palo Alto

Water Sigbin Trend Micro

Description

(Trend Micro) 8220 Gang (also known as “8220 Mining Group,” derived from their use of port 8220 for command and control or C&C communications exchange) has been active since 2017 and continues to scan for vulnerable applications in cloud and container environments. Researchers have documented this group targeting Oracle WebLogic, Apache Log4j, Atlassian Confluence vulnerabilities, and misconfigured Docker containers to deploy cryptocurrency miners in both Linux and Microsoft Windows hosts. The group was documented to have used Tsunami malware, XMRIG cryptominer, masscan, and spirit, among other tools in their campaigns.

Operations 5

2021-05 8220 Gangs Recent use of Custom Miner and Botnet https://www.lacework.com/blog/8220-gangs-recent-use-of-custom-miner-and-botnet/

2022-07 8220 Gang Massively Expands Cloud Botnet to 30,000 Infected Hosts https://www.sentinelone.com/blog/from-the-front-lines-8220-gang-massively-expands-cloud-botnet-to-30000-infected-hosts/

2022-10 8220 Gang Cloud Botnet Targets Misconfigured Cloud Workloads https://www.sentinelone.com/blog/8220-gang-cloud-botnet-targets-misconfigured-cloud-workloads/

2022-11 8220 Gang Continues to Evolve With Each New Campaign https://sysdig.com/blog/8220-gang-continues-to-evolve/

2023-05 8220 Gang Evolves With New Strategies https://www.trendmicro.com/en_us/research/23/e/8220-gang-evolution-new-strategies-adapted.html

Reports & References 4

https://blog.talosintelligence.com/cryptomining-campaigns-2018/ https://www.radware.com/security/ddos-threats-attacks/threat-advisories-attack-reports/the-8220-gang-targeting-cloud-providers/ https://www.imperva.com/blog/imperva-detects-undocumented-8220-gang-activities/ https://www.trendmicro.com/en_us/research/24/f/water-sigbin-xmrig.html

ETDA Profile

8220 Gang

Origin

China

First Seen 2017

Motivation

Financial gain

View on ETDA APT Groups ↗