Craft CMS Zero-Day RCE Exploitation by Mimo Group (CVE-2025-32432, CVSS 10.0)

Craft CMS Zero-Day RCE Exploitation by Mimo Group (TL-2026-0264), also tracked as Operation Mimolette, is a critical-severity software vulnerability scored CVSS 10, first published 2026-03-21. It is attributed to Hezb (Turkey) with high confidence, affects Craft CMS Craft CMS, references 2 CVEs (CVE-2025-32432, CVE-2024-58136), maps to 18 MITRE ATT&CK techniques (T1018, T1021, T1027), and is covered by 9 detection rules and 30 indicators of compromise.

Key facts for TL-2026-0264

Threat ID
TL-2026-0264
Also known as
Operation Mimolette, Mimo Craft CMS Campaign
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L)
Status
MONITORING
Category
VULNERABILITY
First published
2026-03-21
Last reviewed
2026-03-21
Attribution
Hezb
Attribution confidence
HIGH
Nation-state nexus
Turkey
Motivation
FINANCIAL
Target sectors
technology, media, e-commerce, education, government, small-business, web-hosting
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
30

Malware and tooling in Craft CMS Zero-Day RCE Exploitation by Mimo Group

Malware and tooling: IPRoyal Pawns, Mimo Loader, xmrig, GSocket, UPX

Critical unauthenticated remote code execution vulnerability in Craft CMS (CVE-2025-32432, CVSS 10.0) actively exploited since February 2025 by the Mimo threat group to deploy cryptocurrency miners, residential proxyware, and web shells. Chained with Yii framework flaw CVE-2024-58136 for full server compromise. Added to CISA KEV March 20, 2026 with remediation deadline April 3, 2026.

How Craft CMS Zero-Day RCE Exploitation by Mimo Group works

CVE-2025-32432 is a maximum-severity code injection vulnerability (CWE-94) in Craft CMS affecting versions 3.0.0-RC1 through 3.9.14, 4.0.0-RC1 through 4.14.14, and 5.0.0-RC1 through 5.6.16. The flaw resides in the asset transform generation feature, specifically the /index.php?p=actions/assets/generate-transform endpoint, and enables unauthenticated remote code execution.

The exploitation chain operates in three stages. First, an attacker plants malicious PHP code by sending a crafted GET request with a return URL parameter containing PHP code (e.g., <?=exec($_GET[''cmd'']);die()?>), which Craft CMS saves into a server-side PHP session file at /var/lib/php/sessions/sess_[SESSION_ID]. Second, the attacker exploits the __class bypass in the image transform endpoint by sending a POST request with a malicious JSON payload containing a specially crafted field prefix (''as hack'') that triggers CVE-2024-58136, an input validation flaw in the Yii 2 framework (versions before 2.0.52). This loads the PhpManager gadget and points it to the poisoned session file. Third, when PhpManager loads the session file, the attacker''s PHP payload executes, granting full remote code execution.

The vulnerability was discovered by Orange Cyberdefense SensePost and first observed being exploited in the wild in mid-February 2025, approximately two months before public disclosure on April 10, 2025. By mid-April 2025, approximately 13,000 vulnerable Craft CMS instances were identified globally, with nearly 300 confirmed compromised.

The Mimo threat group (also known as Hezb), a financially motivated intrusion set believed to be physically located in Turkey and active since March 2022, has been the primary exploiter of this vulnerability. Mimo''s attack chain deploys a PHP web shell for persistent access, then downloads and executes a shell script named ''4l4md4r.sh'' using curl, wget, or Python''s urllib2 library (distinctively aliased as ''fbi''). The script deploys the 4l4md4r Go-based loader, which installs the alamdar.so LD_PRELOAD rootkit for process hiding, the IPRoyal residential proxyware (hezb.x86_64) for bandwidth monetization, and the XMRig cryptocurrency miner for Monero mining via MoneroOcean and C3Pool.

Mimo has a history of exploiting high-profile vulnerabilities including CVE-2021-44228 (Log4j), CVE-2022-26134 (Confluence), CVE-2023-27350 (PaperCut), and CVE-2023-46604 (ActiveMQ). The group has also deployed the Mimus ransomware, a Go-based fork of MauriCrypt. The campaign has expanded beyond Craft CMS to target Magento and Docker environments.

CISA added CVE-2025-32432 to its Known Exploited Vulnerabilities catalog on March 20, 2026, requiring federal agencies to apply mitigations by April 3, 2026.

MITRE ATT&CK techniques used in TL-2026-0264

discovery

T1018 Remote System Discovery; T1057 Process Discovery

lateral-movement

T1021 Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1564 Hide Artifacts

execution

T1053 Scheduled Task/Job; T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

command-and-control

T1071 Application Layer Protocol; T1090 Proxy

initial-access

T1190 Exploit Public-Facing Application

impact

T1496 Resource Hijacking

persistence

T1505 Server Software Component; T1547 Boot or Logon Autostart Execution; T1574 Hijack Execution Flow

privilege-escalation

T1548 Abuse Elevation Control Mechanism

credential-access

T1552 Unsecured Credentials

resource-development

T1583 Acquire Infrastructure

Affected products and versions in Craft CMS Zero-Day RCE Exploitation by Mimo Group

  • Craft CMS — Craft CMS
    Vulnerable versions: 3.0.0-RC1 through 3.9.14; 4.0.0-RC1 through 4.14.14; 5.0.0-RC1 through 5.6.16
    Fixed in: 3.9.15; 4.14.15; 5.6.17
  • Yii Software — Yii Framework 2
    Vulnerable versions: < 2.0.52
    Fixed in: 2.0.52

Remediation for Craft CMS Zero-Day RCE Exploitation by Mimo Group

Patches

  • Craft CMS 3.9.15 (patches CVE-2025-32432 for 3.x branch)
  • Craft CMS 4.14.15 (patches CVE-2025-32432 for 4.x branch)
  • Craft CMS 5.6.17 (patches CVE-2025-32432 for 5.x branch)
  • Yii Framework 2.0.52 (patches CVE-2024-58136)

Immediate actions

  • Update Craft CMS to patched versions: 3.9.15, 4.14.15, or 5.6.17 immediately
  • Update Yii framework to version 2.0.52 or later
  • Block POST requests to /index.php?p=actions/assets/generate-transform containing __class in the body at WAF level
  • Search web server logs for suspicious POST requests to actions/assets/generate-transform endpoint
  • Check /etc/ld.so.preload for unauthorized entries referencing alamdar.so
  • Scan for processes named 4l4md4r, alamdar, or hezb.x86_64
  • Block known C2 IPs: 85.106.113.168, 109.205.213.203, 193.32.162.10, 15.188.246.198

Workarounds

  • If patching is not immediately possible, disable the asset transform generation endpoint
  • Restrict access to Craft CMS admin endpoints via network-level controls
  • Implement strict Content-Security-Policy headers to limit code execution
  • Discontinue use of Craft CMS if mitigations are unavailable per CISA BOD 22-01 guidance

Longer-term hardening

  • Implement Web Application Firewall rules to detect PHP object injection patterns
  • Deploy endpoint detection for LD_PRELOAD hijacking and rootkit installation
  • Monitor for unauthorized cryptocurrency mining activity via CPU usage anomalies
  • Implement file integrity monitoring on /etc/ld.so.preload and PHP session directories
  • Establish regular vulnerability scanning for CMS platforms
  • Monitor for GSocket-based C2 communications

CVEs associated with Craft CMS Zero-Day RCE Exploitation by Mimo Group

CVE-2025-32432, CVE-2024-58136

Weaknesses (CWE) in Craft CMS Zero-Day RCE Exploitation by Mimo Group

CWE-94

Timeline of Craft CMS Zero-Day RCE Exploitation by Mimo Group

  • Mimo threat group first observed active, initially exploiting Log4j (CVE-2021-44228) and Confluence (CVE-2022-26134) vulnerabilities
  • CVE-2025-32432 first exploited in the wild as a zero-day by unknown threat actors, approximately two months before public disclosure
  • Exploitation attempts detected on Sekoia honeypot infrastructure, beginning sustained observation period through May 2025
  • Craft CMS releases patches in versions 3.9.15, 4.14.15, and 5.6.17 addressing CVE-2025-32432. Yii Framework 2.0.52 patches CVE-2024-58136
  • Full vulnerability details publicly disclosed. Censys identifies approximately 78,984 Craft CMS instances, with nearly 13,000 running vulnerable versions
  • GitHub Advisory GHSA-f3gw-9ww9-jmc3 published with full technical details. Approximately 300 servers confirmed compromised
  • End of sustained exploitation observation period on Sekoia honeypot, covering multiple Mimo intrusion attempts
  • Mimo C2 infrastructure active at 109.205.213.203:21, secondary C2 at 193.32.162.10:21 active May 28-30
  • Sekoia publishes detailed analysis The Sharp Taste of Mimolette documenting Mimo complete Craft CMS exploitation campaign
  • Mimo observed using 15.188.246.198:80 for payload hosting, expanding infrastructure
  • Datadog Security Labs documents Mimo expansion beyond Craft CMS to Magento and Docker environments
  • CISA adds CVE-2025-32432 to Known Exploited Vulnerabilities catalog, orders federal agencies to patch by April 3, 2026
  • CISA BOD 22-01 federal remediation deadline for CVE-2025-32432
  • As of 2026-05-29, CVE-2025-32432 (Craft CMS, CVSS 10.0) is patched but remains actively exploited per its March 20, 2026 CISA KEV listing (deadline Apr 3, 2026), and the Mimo/Hezb actor shows no disruption. With ongoing exploitation of unpatched instances and the actor expanding to Magento/Docker, the threat stays MONITORING.

Sources cited for Craft CMS Zero-Day RCE Exploitation by Mimo Group

More in vulnerability

Detection coverage for TL-2026-0264

As of 2026-03-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0264 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats