Posted on

2026-11-01 — Hugging Face Load/Mine: Malicious Models, GPU Cryptomining and Backdoors: Sentinel Hunts

Threat Overview

Pluto Security published October 29, 2026 research on Load/Mine, a malicious model-repository campaign that returned after takedowns. Researchers identified 31 malicious Hugging Face repositories across seven accounts disguised as small Qwen2 checkpoints, plus linked models. Loading one with Transformers trust_remote_code=True imports attacker-controlled Python before model initialization. Payloads installed hidden GPU miners, watchdogs and, in some versions, SSH-key persistence or reconnecting reverse shells. A later payload targeted privileged GPUStack containers for host-level access. Pluto counted 32,376 downloads including linked models; downloads are not confirmed infections. Researchers observed mining payouts and live worker activity, supporting actual unauthorized compute use, but not a verified victim count.

References

Impacted Systems

Hugging Face Hub model repositories loaded through Python Transformers with trust_remote_code=True; self-hosted inference platforms including Xinference and GPUStack, GPU hosts, notebooks and CI jobs. OS: primarily Linux in analyzed payloads. Deployment: on-prem/self-managed or cloud GPU workers. The Hub was used as a distribution channel; its infrastructure was not reported compromised. Prerequisite: loading attacker-controlled model code or using a framework that enables it. No specific vulnerable Transformers version is asserted: trust_remote_code is an explicit execution permission, not a general Transformers CVE. Related separate unsafe model-code execution paths were reported in vLLM 0.10.1 before 0.14.0 (CVE-2026-22807) and Unsloth Studio before 2026.6.9; neither is required for this campaign. Exposed inference management APIs can increase impact.

Why this matters

ML inference servers and developer systems often hold cloud credentials, SSH keys and valuable GPU compute. A malicious model can execute code before users notice that its weights are fake; deleting the miner does not necessarily remove persistence. The campaign provides concrete host and network indicators plus behavioral follow-ups for model-loader execution.

Exploitation Status

Confirmed malicious repositories, analyzed payloads, persistence code, mining payouts and observed worker activity. Second-wave models appeared after takedowns. Download counts are not compromised host counts. Attribution to a financially motivated Chinese-speaking operator is Pluto’s assessment, not independently verified identity. Infrastructure and repository availability can change quickly.

What this hunt looks for

Prepared file-artifact, process, network, SHA256, Python-loader, shell persistence, new-destination, firewall and Syslog hunts using Pluto’s published indicators. No customer workspace was queried.

Required logs

  • H01 — Reported Load/Mine file artifacts: DeviceFileEvents
  • H02 — Masqueraded kernel worker and miner watchdog: DeviceProcessEvents
  • H03 — Known Load/Mine command infrastructure: DeviceNetworkEvents
  • H04 — Reported Load/Mine payload SHA256: DeviceFileEvents
  • H05 — Model loader Python spawning shell and download tools: DeviceProcessEvents
  • H06 — Python-driven shell profile and SSH persistence: DeviceFileEvents
  • H07 — Python process contacting new public destinations: DeviceNetworkEvents
  • H08 — Firewall events involving Load/Mine IPs: CommonSecurityLog
  • H09 — Linux Syslog Load/Mine persistence traces: Syslog

H01 — Reported Load/Mine file artifacts

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FolderPath contains '/tmp/.cch/' or FolderPath contains '/tmp/.cchx' or FolderPath contains '/tmp/.kitsd' or FolderPath contains '/etc/cron.d/.sync-helper' or FolderPath contains '/tmp/.qa_pwned' or FolderPath contains '/tmp/.cache-hf/g20.py' or FolderPath contains '/tmp/.xi2026' or FileName in~ ('syscore.bin','modeling_evil2.py','modeling_evil6.py','svc.py')
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

H02 — Masqueraded kernel worker and miner watchdog

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where ProcessCommandLine contains '[kworker/u20:1]' or ProcessCommandLine contains 'krxXJ2PKQW.worker' or ProcessCommandLine contains '/tmp/.cch/svc.py' or ProcessCommandLine contains '/tmp/.cch/sync' or ProcessCommandLine contains 'peakminer' or ProcessCommandLine contains '/tmp/.kitsd'
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

H03 — Known Load/Mine command infrastructure

let IOCIPs = dynamic(['212.32.253.3','38.55.133.49','8.137.187.63','103.97.176.121','2.28.9.199','173.249.209.96','212.132.98.170']);
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteIP in (IOCIPs)
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

H04 — Reported Load/Mine payload SHA256

let Hashes = dynamic(['88f4b95a1c3d0a0d9638dc6e69f5bbc9ce0e1b92d069a0e404f60fa5397ee020','414b3cf7a288eaa592b0f03d85c7a6960dbdb855fcb684478b9def9faa95c21d','587e3c3be3c75eb6586d69b25adb4c4208c1cf7d39157946da543dd823117adc','170ef5754bea51c3b05ae4b6c15c541ffa51d972bf8fe0bd3d1c3a19946bd6ac']);
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where SHA256 in~ (Hashes)
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA256
| order by TimeGenerated desc

H05 — Model loader Python spawning shell and download tools

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ('sh','bash','dash','curl','wget','nc','ncat','socat','chmod')
| where InitiatingProcessFileName in~ ('python','python3','python3.11','python3.12','python3.13')
| where InitiatingProcessCommandLine has_any ('huggingface','transformers','xinference','gpustack','modeling_','qwen2')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

H06 — Python-driven shell profile and SSH persistence

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ('.bashrc','.profile','authorized_keys','.sync-helper')
| where ActionType in ('FileCreated','FileModified','FileRenamed')
| where InitiatingProcessFileName in~ ('python','python3','bash','sh','tee')
| project TimeGenerated, DeviceName, FolderPath, FileName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

H07 — Python process contacting new public destinations

let history = DeviceNetworkEvents
| where TimeGenerated between (ago(30d)..ago(3d))
| where InitiatingProcessFileName in~ ('python','python3','python3.11','python3.12')
| summarize KnownIPs=make_set(RemoteIP, 1000) by DeviceId;
DeviceNetworkEvents
| where TimeGenerated >= ago(3d)
| where InitiatingProcessFileName in~ ('python','python3','python3.11','python3.12')
| where isnotempty(RemoteIP) and ipv4_is_private(RemoteIP) == false
| join kind=leftouter history on DeviceId
| where isnull(KnownIPs) or not(set_has_element(KnownIPs, RemoteIP))
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

H08 — Firewall events involving Load/Mine IPs

let IOCIPs = dynamic(['212.32.253.3','38.55.133.49','8.137.187.63','103.97.176.121','2.28.9.199','173.249.209.96','212.132.98.170']);
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where SourceIP in (IOCIPs) or DestinationIP in (IOCIPs)
| extend MatchedIOC = iff(SourceIP in (IOCIPs), SourceIP, DestinationIP)
| project TimeGenerated, MatchedIOC, SourceIP, DestinationIP, DestinationPort, DeviceAction, DeviceVendor, DeviceProduct
| order by TimeGenerated desc

H09 — Linux Syslog Load/Mine persistence traces

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage contains '/tmp/.cch' or SyslogMessage contains 'krxXJ2PKQW.worker' or SyslogMessage contains '/etc/cron.d/.sync-helper' or SyslogMessage contains 'peakminer' or SyslogMessage contains '/tmp/.qa_pwned' or SyslogMessage contains '/tmp/.kitsd'
| project TimeGenerated, HostName, ProcessName, SyslogMessage
| order by TimeGenerated desc

Detection Notes

Highest signal: H02 (masqueraded process and miner login), H03 (reported infrastructure), H04 (hashes) and H01 (specific file paths). H05–H07 are behavioral and noisy on AI development systems. H08 may show only blocked connections. Memfd/fexecve execution may have no on-disk executable or conventional child-process event. Without GPU-host EDR, Linux audit/Syslog, firewall logs or Xinference/GPUStack telemetry in Sentinel, these activities may not be visible. Pluto’s IOC timestamps are October 21–28 and are not proof of current control of each address. No model-repository inventory is confirmed for these customers.

Leave a Reply