MALICIOUS (1) campaign cataloged at 2026-08-23(2).
- The campaign has clearly malicious intent, like infostealers.
- This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.
2026-08-mlflow-otel-instrumentor¶
During installation package downloads and executes an executable. The remote executable appears to be broken but suggests intentions for persistence via systemd services, cryptocurrency mining and propagating over the network. Campaign shows some similarities with 2026-08-boto4
Abuse categories¶
cryptominer
Campaign uses cryptominer.
network-scan
Campaign uses network-scan.
persistence
Campaign uses persistence.
remote_executable
Downloads and executes a remote executable.
typosquatting
The package name is an typosquatting variant of a popular package.
worm
Campaign uses worm.
References¶
Referenced resources may include blog posts about the campaign, malware analysis, sandbox reports, or other relevant information.
IoCs & related URLs¶
URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.
hxxps://file.freestorage-04.bond/files/2026/8/23/10fef88e-73a5-4262-90b8-6585724390e6/boto3_utils.elf?srl=3wyvEAZhXsu6vRNBWi1bug&exp=1787506002