Pluto Security Publishes a Full IOC Field Guide for the Hugging Face Qwen2 Miner Campaign

New York, United States, October 29th, 2026, FinanceWire

Security teams running GPU infrastructure now have a concrete checklist. Pluto Security has published the indicators of compromise for an active cryptominer and backdoor campaign on the Hugging Face Hub. Repository status and download counts below are as of October 25, 2026, and network infrastructure was last observed October 21. Labels follow Pluto Security's investigation: "proven" means shared infrastructure or payload identity, and "linked" means shared technique without proven shared ownership.

What You are Hunting

The campaign hides peakminer cryptominers and persistence inside fake Qwen2 models. Delivery is through trust_remote_code and an auto_map entry in config.json that imports a .py file from the repository. The miner launches fileless via memfd_create, disguises itself as [kworker/u20:1], and in wave one installs to /root/.xinference/cache. The campaign spans 28 repositories across six Hugging Face accounts and a ModelScope mirror, 35 with linked models, and the 16 second-wave repositories were still live five days after Pluto Security reported them.

Malicious Repositories by Account

MENXIANGYU (wave 2, proven, live): qwen2-tiny, qwen2-tiny-2, -3, -4, -5, -6, -9, qwen2-mini-c4, qwen2-mini-c5, qwen2-ezv, llama-tiny-x1019, zz_ext.

wjsbg (wave 2, proven, live): eagle-tiny, qwen2-tiny-zh21, plus a private beacon repo.

soumikmahato (wave 2, live): qwen2-tiny-chat, behind four cover repositories.

r1r13 (wave 2, proven, live): qwen-lora-text-v1.

hhzz667 (wave 1, proven, removed): qwen2-shell, qwen2-tiny, qwen2-mini, qwen2-nano, qwen2-legacy, qwen2-final.

dsxk4mr8tq (wave 1, proven, removed): qwen2-tiny, -gpt2, -lite, -pure, -real, -assets.

wssb123e on ModelScope (wave 1, proven, removed): qwen2-tiny and qwen2-tiny-zh, the binary mirror.

Linked and live: MONIADF-2 (qwen2-hl, qwen2-hl2, qwen2-hl3, qwen2-tiny-hl), vaishupv (xai-probe-v1), oifewuheu (oeoijoewfief) and KzuryHD (qwen-helper).

Wallets and Pools

First-wave payout wallet, live and victim-mined: prl1p9s2a9gdy4n5yfuf5suhya2d2pyvaahmz3n3gzm3npyxkj79m7yyq9kgnrv

soumikmahato/qwen2-tiny-chat wallet, live: prl1pek8rh8yjck5q7596aph7ua7xnkqs8ur9mkfmz8w7xfzcdfcfx5vsx2f4lz

Decoy, dead code, unused everywhere: prl1p0aaff83xc3cvs6f95jj9pwx2uskez9hmrjd2ap2p3mj0nmkl3hfqua63wf

Wave-one Monero wallet, dead: 83sB24CNcALNWZJrWb7zEnY6ZAtneXwfKAWyedqocXrd9cgzrLDcSdEch9xpHu6ZuqUdAh8VEMA15Zy6W5xMfZfPG4whgZj

MONIADF-2/qwen2-hl Monero wallet: 46i5xDQq56pCJW6vg1kpPwLxmLLNzFB8vHZk58twfKj7VRGZDucSHYY8TYSoZDW6PpTcMEP4UdjWrPhrQdDFNaUDVPekNcc

Shared pool login across the six analyzed second-wave builds: krxXJ2PKQW.worker

Pools: prl-us.kryptex.network:8048 and prl-sg.kryptex.network:8048 (wave 2); pearl-hk.luckypool.io:3361 and :3956, plus pool.hashvault.pro:80 and :443 (wave 1); pearl-sg1.luckypool.io:3360 and de.pearl.herominers.com:1200 (soumikmahato); gulf.moneroocean.stream:10001 (MONIADF-2); mine.c3pool.com:80 (vaishupv); prl-us.kryptex.network:7048 (oifewuheu).

Network Infrastructure

212.32.253.3: ports 443 and 9443 are reverse-shell receivers (qwen2-tiny-5, -6, -9). :8898/lf_py.py is a gated second stage behind a source-IP allowlist that returns a 403 reading "static ip." to other hosts. :8895/ezv is a collector exfil endpoint. :8895 and :8898 host payloads. :8898/kitsd_v12.sh is the zz_ext second stage.

38.55.133.49: :8901/kitsd_v12.sh is an alternate zz_ext second-stage host, and :8901 and :9001 were used for recon exfil and a reverse shell. That command-and-control is now dead.

8.137.187.63: wave-one Alibaba Cloud command-and-control on ports 80, 443, 50053 and 50054, with a /v1/models path and a PWN_<hostname> tag.

103.97.176.121:8899 and hz2006.aihzcc.top host g20_reclaim.py (wjsbg/qwen2-tiny-zh21). 2.28.9.199:7000 takes GPU and metadata exfil (r1r13).

3.112.174.116.sslip.io/sysd-kit.tgz serves a GPU miner and CUDA runtime, and grows-stocks-vatican-flood.trycloudflare.com/beacon is the status receiver, with fields ph, h and pid (soumikmahato).

173.249.209.96:8081/ag.sh is an agent script, and 173.249.209.96:8081/task/<host> and /in/<host> handle command retrieval and result reporting (MONIADF-2). huggingface.co/MONIADF-2/qwen2-hl/resolve/main/kx.tgz hosts an XMRig archive in the repository, and suteeal/qwen2-hl is a ModelScope reference in MONIADF-2 registrations.

212.132.98.170 is a gsocket backdoor host, and 49.12.44.127 and 200.58.80.115 are gs-netcat download mirrors (vaishupv/xai-probe-v1). github.com/peakminer/peakminer/releases is the miner source (oifewuheu/oeoijoewfief).

Miner Binary Locations

Wave one: huggingface.co/dsxk4mr8tq/qwen2-tiny/resolve/main/syscore.bin and its hf-mirror.com copy, hf-mirror.com/hhzz667/qwen2-final/resolve/main/syscore.bin, the ModelScope mirror at www.modelscope.cn/api/v1/models/wssb123e/qwen2-tiny/repo (Revision=master, FilePath=syscore.bin), and huggingface.co/dsxk4mr8tq/qwen2-tiny-assets/resolve/main/sysx.bin.

Wave two: syscore.bin is hosted in six MENXIANGYU mining repositories (qwen2-tiny and -3, -4, -5, -6, -9), with an hf-mirror.com fallback in the flagship loader.

Host and File-System Artifacts

The payload directory /tmp/.cch/ holds sync (the miner binary), svc.py (the watchdog) and o (a log). Additional drop directories are /tmp/.cchx and /tmp/.kitsd. The RC hook line is appended to /root/.bashrc, /root/.profile and ~/.bashrc. The masqueraded process is [kworker/u20:1], whose real cmdline carries the worker ID. Beacon receipts sit in the local Xinference registry as qwen2-tiny <base32> and ezv <base32>. Second-stage landings are /tmp/lf_py.py and /tmp/ezv_proof.txt.

Wave-one specifics: the miner installs to /root/.xinference/cache, cron persistence is /etc/cron.d/.sync-helper, and the infection markers /tmp/.qa_pwned and ~/qa_pwned contain the text PWNED <hostname> uid=<uid>. The wave-one SSH backdoor key, planted in six paths, is:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDYjYyvcEJW5ZVgsESyZE5uxqSwN2vmd5asrWICeHxu1 qx-5090-op

Other builds: /tmp/.cache-hf/g20.py (wjsbg reclaim script), the marker EAGLE_MODEL_MARKER_93bd (wjsbg/eagle-tiny), /tmp/.c/kit.tar.gz with /tmp/.c/app/ and /tmp/.c.pid, /tmp/.c.log and /tmp/.c.out (soumikmahato), and the MONIADF-2 set: /tmp/.h9ag and /tmp/.h9mark (content hlhf), /root/.mx, /tmp/.mx, /var/tmp/.mx, /dev/shm/.mx, and /root/.hl/poll.sh, boot.out and t.out, with registry receipts hlrce, hlcmd- and hlout-. The vaishupv collection file is /tmp/.xai_loot.

File Hashes

Wave-two syscore.bin, 40,625,780 bytes, SHA-256 88f4b95a1c3d0a0d9638dc6e69f5bbc9ce0e1b92d069a0e404f60fa5397ee020, unpacked BuildID c492732de98117b7b28ce0e410f5966e1232e9dc.

Wave-two modeling_evil2.py, SHA-256 414b3cf7a288eaa592b0f03d85c7a6960dbdb855fcb684478b9def9faa95c21d.

Wave-one syscore.bin, 33.8 MB, SHA-256 587e3c3be3c75eb6586d69b25adb4c4208c1cf7d39157946da543dd823117adc.

Wave-one sysx.bin, 7.9 MB, SHA-256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d.

soumikmahato sysd-kit.tgz, SHA-256 6b1e531c9e799a6df1472acc143c6eaec6ea4dd22f997458ba519644d125197e. configuration_parasit.py, SHA-256 9d62179c94faf0c8eb86704973c218c229e92c71c0ed60a5e85d4bcc69c13f40. modeling_parasit.py, SHA-256 6a837d3042b9b8b6266c75b07e22ea8e7a7108083efa48ff0aedba7fa24fb57c.

Quick Checks on a Suspect Host

Pluto Security supplied these checks:

grep -c "svc.py" /root/.bashrc /root/.profile ~/.bashrc 2>/dev/null

ls -la /tmp/.cch/ 2>/dev/null

grep -a "krxXJ2PKQW" /proc/*/cmdline 2>/dev/null

ss -tnp | grep -E "212\.32\.253\.3:(443|9443|8898)" 2>/dev/null

grep "qx-5090-op" /root/.ssh/authorized_keys ~/.ssh/authorized_keys /home/xinference/.ssh/authorized_keys 2>/dev/null

No single missing indicator rules out compromise.

If You Find It

If you loaded one of the listed models with custom code enabled, check the machine for compromise even if loading failed or GPU usage looks normal. The payload runs before model initialization, and its backdoors can remain after mining stops. Isolate affected machines from production networks, restrict outbound access, and preserve process details, connections, logs, model cache files, startup changes and registry entries before deleting anything. Then remove the loaders, miners, watchdogs and backdoors, and check shell startup files, cron jobs, SSH authorized_keys and model registrations. Because the payload also deletes competing miners and their startup entries, review deletions as well as additions. Killing the miner or deleting the model does not remove persistence. Rebuild from a trusted image if you cannot establish the host's integrity.

From a clean machine, revoke or rotate the tokens, cloud credentials, passwords and SSH keys the compromised process could reach, and review their recent use. Removing an attacker's key from authorized_keys does not invalidate credentials they may have copied.

Prevention Worth Setting Now

Review the .py files an auto_map points to before the flag is set, as the Transformers security policy advises, and pin the reviewed revision before loading it. Require authentication on the Xinference API and limit its reachability. Run untrusted code with limited privileges, restricted network access and no production secrets. Pluto Security notes that a static check at upload time for subprocess, socket, ctypes or raw-IP network calls in files referenced by auto_map would have caught these payloads, and that a clean scan alone is not a reason to trust a repository.

Contact