GINC Technology
GINC-APT-0338 · Criminal

Returned Libra

Also 8220 Gang, Water Sigbin, 8220 Mining Group.

Category
Criminal · Financially motivated: ransomware, fraud and theft.
Origin
China(high confidence)
Motivation
Financial gain
Seen
2017
Sources
6 sources carry it
Identifier
GINC-APT-0338 · returned-libra

What it is

Returned Libra, also known as 8220 Mining Group, is a cloud threat actor group that has been active since at least 2017. Tools commonly employed during their operations are PwnRig or DBUsed which are customized variants of the XMRig Monero mining software. The Returned Libra mining group is believed to have originated from a GitHub fork of the Rocke group's software. Returned Libra has elevated its mining operations with the use of cloud service platform credential scrapping.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names
8220 Gang, Water Sigbin, 8220 Mining Group

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Tools

The tools and malware families the sources tie to it.

  • CloudDuke
  • Miner-C
  • POWERSOURCE
  • POWERSTATS
  • Power Loader
  • PowerDuke
  • PowerRAT
  • TURNEDUP
  • Xploit

Sources