Craft CMS Zero-Day RCE Exploitation by Mimo Group (CVE-2025-32432, CVSS 10.0) — Threadlinqs Intelligence
As of 2026-05-30, Craft CMS Zero-Day RCE Exploitation by Mimo Group (CVE-2025-32432, CVSS 10.0) is a critical-severity vulnerability threat attributed to Hezb (Turkey), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 30 indicators of compromise.
Threat ID: TL-2026-0264 · Severity: CRITICAL · CVSS: 10 · Status: MONITORING · Category: VULNERABILITY
Attribution: Hezb · Turkey · FINANCIAL
Critical unauthenticated remote code execution vulnerability in Craft CMS (CVE-2025-32432, CVSS 10.0) actively exploited since February 2025 by the Mimo threat group to deploy cryptocurrency miners,
CVE-2025-32432 is a maximum-severity code injection vulnerability (CWE-94) in Craft CMS affecting versions 3.0.0-RC1 through 3.9.14, 4.0.0-RC1 through 4.14.14, and 5.0.0-RC1 through 5.6.16. The flaw resides in the asset transform generation feature, specifically the /index.php?p=actions/assets/generate-transform endpoint, and enables unauthenticated remote code execution.
The exploitation chain operates in three stages. First, an attacker plants malicious PHP code by sending a crafted GET request with a return URL parameter containing PHP code (e.g., <?=exec($_GET[''cmd'']);die()?>), which Craft CMS saves into a server-side PHP session file at /var/lib/php/sessions/sess_[SESSION_ID]. Second, the attacker exploits the __class bypass in the image transform endpoint by sending a POST request with a malicious JSON payload containing a specially crafted field prefix (''as hack'') that triggers CVE-2024-58136, an input validation flaw in the Yii 2 framework (versions before 2.0.52). This loads the PhpManager gadget and points it to the poisoned session file. Third, when PhpManager loads the session file, the attacker''s PHP payload executes, granting full remote code execution.
The vulnerability was discovered by Orange Cyberdefense SensePost and first observed being exploited in the wild in mid-February 2025, approximately two months before public disclosure on April 10, 2025. By mid-April 2025, approximately 13,000 vulnerable Craft CMS instances were identified globally, with nearly 300 confirmed compromised.
The Mimo threat group (also known as Hezb), a financially motivated intrusion set believed to be physically located in Turkey and active since March 2022, has been the primary exploiter of this vulnerability. Mimo''s attack chain deploys a PHP web shell for persistent access, then downloads and executes a shell script named ''4l4md4r.sh'' using curl, wget, or Python''s urllib2 library (distinctively aliased as ''fbi''). The script deploys the 4l4md4r Go-based loader, which installs the alamdar.so LD_PRELOAD rootkit for process hiding, the IPRoyal residential proxyware (hezb.x86_64) for bandwidth monetization, and the XMRig cryptocurrency miner for Monero mining via MoneroOcean and C3Pool.
Mimo has a history of exploiting high-profile vulnerabilities including CVE-2021-44228 (Log4j), CVE-2022-26134 (Confluence), CVE-2023-27350 (PaperCut), and CVE-2023-46604 (ActiveMQ). The group has also deployed the Mimus ransomware, a Go-based fork of MauriCrypt. The campaign has expanded beyond Craft CMS to target Magento and Docker environments.
CISA added CVE-2025-32432 to its Known Exploited Vulnerabilities catalog on March 20, 2026, requiring federal agencies to apply mitigations by April 3, 2026.
Target sectors: technology, media, e-commerce, education, government, small-business, web-hosting
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 30 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2025-32432, CVE-2024-58136, T1190, T1203, T1059, T1505, T1547, T1053, T1548, T1574, T1564, T1027