Mimo Hackers Target Craft CMS Flaw to Deploy Cryptomining and Proxy Services
On May 28, 2025, cybersecurity analysts reported an alarming trend in which financially motivated hackers have been exploiting a serious vulnerability in the Craft Content Management System (CMS)—designated as CVE-2025-32432. This flaw, which allows for remote code execution, has enabled the attackers to deploy various malicious payloads, including a cryptocurrency miner and residential proxy services, notably using a loader identified as Mimo Loader.
The vulnerability, characterized as a maximum severity risk, was patched in Craft CMS versions 3.9.15, 4.14.15, and 5.6.17. It first came to light in April 2025 during investigations by Orange Cyberdefense’s SensePost team, following its initial exploitation in attacks that were documented earlier in February. In a recent report from Sekoia, cybersecurity experts outlined how these threat actors have effectively weaponized CVE-2025-32432 to gain unauthorized access to the affected systems, subsequently deploying a web shell to facilitate ongoing remote access.
Once the attackers establish this foothold, they utilize the web shell to execute a shell script—specifically named “4l4md4r.sh”—retrieving it from a remote server through common tools like curl, wget, or the Python library urllib2. The consistent use of these methods illustrates the attackers’ strategic approach to maintaining persistence in compromised environments, thereby ensuring their ongoing operations.
Craft CMS has emerged as a significant target for exploitation due to its widespread usage across various sectors, making it an attractive vector for cybercriminals. The United States appears to be one of the primary locations affected, raising concerns among business owners and IT professionals about the risks associated with unpatched software vulnerabilities.
In terms of tactics employed, the Pentagon’s MITRE ATT&CK framework helps elucidate the methods likely leveraged in these attacks. Initial access through the identified vulnerability represents a critical entry point for adversaries, followed by actions focusing on persistence via the web shell installation. Furthermore, privilege escalation techniques might have been employed to solidify the attackers’ control over the compromised systems, allowing further payload deployments.
The implications of these attacks underscore the urgent need for regular software updates and robust cybersecurity practices. Business owners are advised to prioritize patch management, ensuring that their systems are protected against such vulnerabilities, to mitigate the risks posed by organized cyber threats. It is crucial for organizations to remain vigilant and informed about emerging threats to safeguard their digital assets effectively.
As this situation continues to evolve, the cybersecurity community is advised to monitor developments regarding CVE-2025-32432 and related cyber activities. Business leaders and technical teams should engage in proactive strategies to bolster their defenses against such exploits, thereby reducing potential exposure to devastating financial losses and reputational damage.
