Spilling the Beans on Multiplatform Cryptominer Soco404

Wiz analyzed the Soco404 campaign that exploited cloud environment vulnerabilities and misconfigurations to deploy cryptominers.¹ Soco404 payloads were embedded in fake 404 HTML pages hosted on websites built using Google Sites. Note, however, that Google has taken down the sites since they were reported.

The researchers identified nine domains as indicators of compromise (IoCs), which WhoisXML API further analyzed. Our deep dive led to these discoveries:

• 1,516 unique client IPs communicated with four IoCs via 18,052 DNS requests made on 15–23 July 2025 based on Internet Abuse Signal Collective (IASC) data
• Two domains were dubbed likely to turn malicious upon registration 65–165 days prior to being reported as IoCs
• 9,459 email-connected domains, one turned out to be malicious
• 17 IP addresses, 15 turned out to be malicious
• One IP-connected domain
• 45 string-connected domains

Download a sample of the threat research materials now or contact sales to discuss your intelligence needs for threat detection and response or other cybersecurity use cases.

—

• [1] https://www.wiz.io/blog/soco404-multiplatform-cryptomining-campaign-uses-fake-error-pages-to-hide-payload#iocs-77