CVE-2024-46483MalwarePublished 27 May 2025

The Sharp Taste of Mimo'lette: Analyzing Mimo's Latest Campaign targeting Craft CMS

Source AlienVault OTX General

Severity

Unrated

Not a vulnerability record

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 1.1% chance of exploitation in 30 days – higher than 65% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Data as of 26 Oct 2026, 06:26 UTC

Description

The Mimo intrusion set is exploiting CVE-2024-46483, a Remote Code Execution vulnerability in Craft CMS, to deploy webshells and execute malicious payloads. The attack chain includes downloading infection scripts and deploying a loader, cryptominer (XMRig), and residential proxyware (IPRoyal) for financial gain. The group uses unique identifiers such as '4l4md4r' and 'n1tr0' and has been linked to operators 'EtxArny' and 'N1tr0'. Detection can focus on unusual processes in temporary directories and kernel module changes. The campaign targets Craft CMS installations globally, with a focus on financially motivated exploitation rather than geopolitical objectives. The threat is medium severity due to the impact on confidentiality and availability, ease of exploitation via RCE, and the scope of affected web servers. Organizations using Craft CMS should prioritize patching and monitoring for indicators of compromise.

Impact

This threat can have widespread impact on organizations using Craft CMS, particularly those with internet-facing web servers. Successful exploitation results in unauthorized remote code execution, leading to full system compromise. Attackers can deploy cryptominers, which degrade system performance and increase operational costs through higher power consumption. The use of residential proxyware can implicate compromised systems in illicit activities, potentially damaging organizational reputation and exposing them to legal risks. Persistent webshells enable ongoing unauthorized access, increasing the risk of data theft, further malware deployment, or lateral movement within networks. The financial motivation behind the campaign suggests a high likelihood of continued exploitation, potentially affecting a broad range of sectors including media, e-commerce, and government websites that rely on Craft CMS. The manipulation of kernel modules and obfuscated payloads complicates detection and remediation, increasing the risk of prolonged compromise. Overall, the threat undermines confidentiality, integrity, and availability of affected systems, with medium severity given the current scope and exploitation complexity.

Defensive guidance

Organizations should immediately verify if their Craft CMS installations are vulnerable to CVE-2024-46483 and apply any available patches or updates from the vendor. In the absence of patches, implement virtual patching via web application firewalls (WAF) to block exploitation attempts targeting the RCE vulnerability. Conduct thorough endpoint and server monitoring focusing on unusual process execution, especially processes running from temporary directories, and monitor for unexpected kernel module loads or changes. Deploy network monitoring to detect outbound connections consistent with cryptomining pools or proxyware traffic, such as connections to known XMRig or IPRoyal infrastructure. Implement strict access controls and multi-factor authentication for CMS administrative interfaces to reduce the risk of initial compromise. Regularly audit web server file systems for unauthorized webshells or suspicious scripts. Employ threat hunting techniques using the unique identifiers '4l4md4r' and 'n1tr0' to detect related artifacts. Educate security teams on the TTPs used by Mimo, including obfuscation and kernel module manipulation, to improve incident response readiness. Finally, isolate and remediate infected systems promptly to prevent lateral movement and further damage.

Indicators of compromise

Domains 2

n1tr0.online
windows.n1tro.cyou

IP addresses 1

85.106.113.168

Hashes 9

03471b7a82e2001714b355aaab10c532
e11365871cc409651fb216d2f5253a6c
2b76bc5457143d069676587401cad105bfbd53f3
f7f2ef6f65d301e78a1cc855c22dd9395ed5e507
1aa4d88a38f5a27a60cfc6d6995f065da074ee340789ed00ddc29abc29ea671e
2e46816450ad1b4baa85e2a279031f37608657be93e1095238e2b6c36bbb3fd5
3a71680ffb4264e07da4aaca16a3f8831b9a30d444215268e82b2125a98b94aa
7868cb82440632cc4fd7a451a351c137a39e1495c84172a17894daf1d108ee9a
fc04f1ef05847607bce3b0ac3710c80c5ae238dcc7fd842cd15e252c18dd7a62

CVEs 2

CVE-2024-46483
CVE-2025-32432

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 26 Feb 2026, 08:39 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details