Pluto Security‘s attribution rests on evidence the operator left in the code and on a mistake that tied the accounts together. Across a cryptominer and backdoor campaign spanning 28 repositories, the language of the code comments, the choice of infrastructure, the target set and the timing of activity all point one way: a financially motivated, Chinese-speaking operator or small group.
The comments in the source
Wave-one code carries comments in Simplified Chinese that read as operational notes. Pluto Security cites “daemon disguise name” for process masquerading, “blend into Xinference directory” for the targeted environment, and “kill rival processes” for clearing competing miners. These are English renderings of comments written in Simplified Chinese.
Infrastructure that lines up
The hosting reinforces the language evidence. The wave-one command-and-control server, 8.137.187.63, sits on Alibaba Cloud. The miner binary is mirrored on ModelScope and hf-mirror.com. The targeting assumes Xinference and Tencent Cloud, and the SSH injection paths include the xinference user’s home. Pluto Security says language and hosting place the operator in the Chinese-speaking ML ecosystem.
The clock
Activity clusters between 18:38 and 21:19 UTC, which is 02:38 to 05:19 China Standard Time, late night in that zone.
The operator’s own slip
The link between accounts came from a mistake. A test account held backup copies of the loader, modeling_evil.py.bak-src and modeling_evil.py.bak-sync, in the qwen2-tiny-lite repository. They were older versions of the same malware with different download URLs. Those URLs did not point at the test account, dsxk4mr8tq. They pointed at hhzz667 on Hugging Face and wssb123e on ModelScope. The operator had copied production code into a new test account, updated the URLs in the main file and forgot the backups, so its own version history connected the accounts.
Profit as the motive
Pluto Security says the money points the same way. The payoff is Pearl and Monero wallets with real pool payouts: the first-wave wallet has received about 2,276 PRL, roughly $5,000, across 716 transactions, and its live workers report peakminer. The tooling is commodity, with throwaway accounts, a leaked token and development files named evil. Once its own miner is running, the payload also removes rival miners so that the compute goes to its own. In Pluto Security’s words, the wallets and tradecraft show the goal is profit.
One line is different. The soumikmahato “parasit” build carries Indonesian-language comments and a different build system. Pluto Security says that fits either a second operator in the same niche or one operator running a deliberately different-looking line for redundancy.
What the “evil” filename shows
In wave one, the file name modeling_evil.py turned up on the development account, dsxk4mr8tq. The wave-one production build, qwen2-final, used clean names, Qwen2Config and modeling_qwen2.py, and the EvilConfig naming only existed in the dev account. The wave-two flagship is different: MENXIANGYU/qwen2-tiny points auto_map at modeling_evil2.EvilModel and had been downloaded 18,012 times by October 25.
The development trail
The code shows a clear progression. Phase one, on September 21, was a 37-line SSH backdoor that planted a single ed25519 key in authorized_keys. Phase two, on September 21 and 22, grew to 102 lines, with key injection in six paths and .bashrc injection. Phase three, on September 22, was the 305-line fileless miner, qwen2-final. The wave-one command-and-control ran on four ports, and Pluto Security counts more than 40 code iterations across the campaign.
Pluto Security’s assessment
Pluto Security’s assessment is a financially motivated, Chinese-speaking operator or small group, based on the code comments, the hosting, the targets and the timing, with more than 21,000 downloads across the campaign and its linked models. Language and hosting place the operator in the Chinese-speaking ML ecosystem, and the wallets and tradecraft show the goal is profit.