What Is Soco404 Malware and How Do Fake 404 Pages Deliver It?
Soco404 is a new cyber threat campaign that delivers platform-specific malware through fake 404 error pages. This technique embeds base64-encoded malicious payloads inside error screens hosted on Google Sites and compromised servers. When unsuspecting users or systems load these pages, the malware gets executed directly in memory, bypassing traditional security measures. The campaign targets both Linux and Windows operating systems using customized loaders (soco.sh for Linux and ok.exe for Windows), which mimic legitimate processes to avoid detection. Researchers found it abuses PostgreSQL features, misconfigured servers, and HTML smuggling to deploy crypto-mining malware stealthily.
Quick answer: Soco404 is a cryptomining malware campaign reported by cloud security firm Wiz in 2025. Attackers exploit exposed or vulnerable servers (such as Apache Tomcat, PostgreSQL and Atlassian Confluence), then fetch platform-specific payloads that deploy the XMRig Monero miner on Linux and Windows. The fake 404 error pages hosted on sites such as Google Sites hide the payload code.
Key takeaways
- Soco404 is mainly a server-side problem. The entry points reported are internet-exposed, vulnerable or misconfigured services, not ordinary users clicking an error page.
- The aim is cryptomining: it burns your CPU and electricity and can hide other activity.
- Reported tricks include running code in memory, renaming processes to look like kernel threads, clearing logs, and watchdog processes that restart the miner.
- Defence: patch internet-facing software, close exposed databases, harden credentials, monitor CPU and egress, and use endpoint detection.
- Details here come from public reporting. Check the original research for indicators before acting.
What is the Soco404 campaign?
Soco404 is the name given to an active cryptomining campaign described in public research by Wiz in 2025. The name comes from the attackers' use of fake "404 error" pages to host malicious code. The pages were reported on platforms such as Google Sites and on compromised servers. Wiz's write-up is the primary source: Soco404 multiplatform cryptomining campaign.
How does the attack work?
As publicly reported, the sequence is:
- Initial access. Attackers find internet-facing servers with known vulnerabilities or weak configuration. Services named in reporting include Apache Tomcat, PostgreSQL and Atlassian Confluence.
- Payload fetch. The compromised server runs a command that downloads a platform-specific script or binary from an attacker-controlled location. The payload content was hidden in the HTML of a page that looked like a 404 error.
- In-memory execution. The payload is decoded and run so that little is written to disk, which makes disk-based scanning less effective.
- Cryptominer. The goal is to run a Monero miner (XMRig) using the victim's CPU.
- Persistence and evasion. On Linux, reporting describes process names made to resemble kernel threads, scheduled jobs and log tampering. On Windows, it describes services with random names, registry or startup entries and disabling logging.
Why use a fake 404 page?
A 404 page looks like noise. Security filters often treat error pages as harmless, and hosting the content on a trusted platform makes domain reputation checks less useful. The page is a delivery mechanism, not the vulnerability. The vulnerability is the unpatched or exposed service that lets the attacker run the download command in the first place.
Is this a risk for ordinary users?
The reported infections target servers and cloud workloads, not people browsing at home. An ordinary user visiting a 404 page is not the described route. Even so, users should be careful about running pasted commands and downloading files from unknown links. Treat the original claim that clicking a fake error page "drops malware" with caution; read the research.
How can you tell if a server is affected?
- Sustained high CPU with no matching workload.
- Unknown processes with kernel-like names, or processes running from temporary directories or deleted files.
- New cron entries, systemd services or Windows services you did not create.
- Outbound connections to mining pools or unfamiliar hosts, found in firewall or flow logs.
- Gaps or truncation in system logs. On Linux check
lastand auth logs, on Windows event log clearing events.
Use the indicators in the vendor report as a starting point, but treat them as time-limited.
How do you defend against it?
- Patch internet-facing services such as Tomcat, Confluence and application frameworks. Use the National Vulnerability Database to track advisories.
- Do not expose databases like PostgreSQL to the internet. Restrict by firewall and use strong, unique credentials and TLS.
- Remove default and weak credentials on management consoles such as Tomcat Manager.
- Limit egress. Servers rarely need to reach arbitrary hosts. Block outbound traffic by default and allow what is needed.
- Monitor CPU, process trees and network flows. Use endpoint detection that can see memory-based activity.
- Centralise logs off the host so attackers cannot erase them.
- Least privilege. Run services as unprivileged accounts.
What should you do if you find a miner?
Isolate the host and preserve evidence (memory and disk image if you can). Find the initial access path, because removing the miner without closing the hole invites re-infection. Rotate credentials and secrets on the host. Rebuild from a known-good image rather than cleaning by hand, check neighbouring systems, then patch and monitor. Indian organisations should consider reporting significant incidents to CERT-In.
Why does cryptomining matter if it is "only" mining?
Cost and performance suffer, but the bigger concern is that someone already has code execution on your server. The same access can be used for data theft, ransomware or lateral movement. Treat a miner as evidence of a breach.
Next steps
To learn detection and response properly, see WebAsha's incident handler training. For other recent campaigns, read GhostContainer malware on Exchange servers.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
