Threat reportSupply ChainTL-2026-4776
Hugging Face 'Load/Mine' Campaign: Malicious Qwen2 Model Repos Abuse trust_remote_code to Hijack GPUs for Pearl (PRL) Mining and Backdoor Xinference/GPUStack Hosts
Hugging Face 'Load/Mine' Campaign (TL-2026-4776), also tracked as Load/Mine, is a high-severity supply-chain compromise, first published 2026-10-29. It has no confirmed attribution, affects Hugging Face Hugging Face Hub model repositories / transformers, maps to 18 MITRE ATT&CK / ATLAS techniques (AML.T0010.003, T1027.002, T1036.005), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK / ATLAS
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4776
- Threat ID
- TL-2026-4776
- Also known as
- Load/Mine, Hugging Face Qwen2 miner campaign, peakminer campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, research, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in Hugging Face 'Load/Mine' Campaign
Malware and tooling: CloudFlare Tunnel
How Hugging Face 'Load/Mine' Campaign works
At least 31 malicious Hugging Face repositories (plus a ModelScope mirror) abuse trust_remote_code and config.json auto_map so Python runs the moment a model loads, deploying the 'peakminer' cryptominer, reverse shells, SSH/cron persistence and a container-escape script against self-hosted Xinference and GPUStack GPU servers. A related fake Solana starter kit on GitHub delivers a NetSupport Manager RAT to Windows developers. Attributed to a financially motivated, Chinese-speaking operator.
Pluto Security's 'Load/Mine' report (published 2026-10-29) and BleepingComputer coverage describe a two-wave campaign distributed through fake small Qwen2 models on Hugging Face. Calling from_pretrained() with trust_remote_code=True imports a Python module named in the repository's config.json auto_map (for example modeling_evil.py, modeling_evil2.py, modeling_parasit.py), and its top-level code executes before the model class is even returned. The repositories carry a 42-byte decoy model.safetensors; the real payload is a packed binary (syscore.bin / sysx.bin) that is the 'peakminer' miner.
Wave one began on 2026-09-21 with a pure SSH-backdoor repository (qwen2-shell) and by 2026-09-22 had evolved into a fileless miner that runs from memory via memfd_create/fexecve, installed under /root/.xinference/cache and using C2 at 8.137.187.63 (Alibaba Cloud). Wave two, which reappeared within days of the first takedown, comprised 19 repositories across five accounts (MENXIANGYU alone had 13). The flagship MENXIANGYU/qwen2-tiny rose from 7,354 downloads on 2026-10-20 to 18,012 on 2026-10-25 and 28,412 by 2026-10-28; a copycat htt0118/qwen2-tiny was still live at publication. The report counts 29,818 campaign downloads (32,376 including 13 linked repositories).
The wave-two payload writes a watchdog (/tmp/.cch/svc.py) that relaunches the miner every 120 seconds and removes competing miners, appends launch hooks to /root/.bashrc, /root/.profile and user .bashrc files, installs cron persistence (/etc/cron.d/.sync-helper) and adds an ed25519 SSH key to authorized_keys in several locations including the xinference user's home. The miner process masquerades as the kernel thread [kworker/u20:1]; the packed binary's UPX markers were altered from 'UPX!' to 'PEK!' to hinder unpacking. A separate process connects a reverse shell to 212.32.253.3 on 443 or 9443 and retries after every disconnect; other components use a gsocket backdoor (212.132.98.170), a Cloudflare tunnel beacon, a gated stage served from 212.32.253.3:8898 (lf_py.py), and GPU/host metadata collection to 2.28.9.199:7000. Status reports to the operator are encoded as Xinference model-registry entries (qwen2-tiny-<base32>). A privileged container-escape script (qa-whl-1021) activates LVM volumes from inside a container, mounts candidate host disks and locates the host root or GPUStack's /var/lib/gpustack to gain root on the underlying host.
Payouts go to Pearl (PRL) wallets via Kryptex, LuckyPool and HeroMiners pools (Monero pools such as HashVault, MoneroOcean and c3pool also appear); the first-wave Pearl wallet had received about 2,276 PRL (~$5,000) across 716 transactions and mining continued after takedown. A shared pool login (krxXJ2PKQW.worker) appears across six analyzed wave-two builds. Nine machines of a research GPU cluster were observed mining simultaneously before jobs stopped about six minutes later, attributed to admin intervention. JFrog and Protect AI scanning did not flag the wave-two flagship, and JFrog noted it was 'not a machine-learning model'.
A related but distinct activity cluster: the GitHub repository SolanaUpdateTools/solana-starter-kit (created November 2025, 286 stars) tells developers to paste a PowerShell one-liner from the README that assembles a URL on developer-update.app and executes a script in memory, installing a NetSupport Manager RAT with C2 at maxwintodaybtc.com, persisting at login and showing a fake 'developer functionality temporarily paused' error. Air Security reported the kit; eSentire links the NetSupport operator to earlier fake TradingView 'AI signal' campaigns. The source does not state that the Solana kit and the Hugging Face miner share an operator.
Attribution is to a financially motivated, Chinese-speaking operator based on Simplified Chinese code comments, C2 on Alibaba Cloud and late-night China-timezone activity; no named actor or nation-state is asserted. No CVE is assigned: the abuse is of an intended-but-dangerous feature (trust_remote_code). Hosts that loaded these models should be treated as fully compromised because SSH-key and reverse-shell backdoors persist after miner removal. Severity HIGH is analyst-assigned. BeaconBeagle lookups for the C2 IPs returned no data (HTTP 404), so no C2 correlation is recorded.
MITRE ATT&CK / ATLAS techniques used in TL-2026-4776
initial-access
AML.T0010.003 AI Supply Chain Compromise: Model
Defense Evasion
T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1620 Reflective Code Loading
Persistence
T1053.003 Cron; T1098.004 SSH Authorized Keys; T1546.004 Unix Shell Configuration Modification
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1059.006 Python; T1204.002 Malicious File
Discovery
T1082 System Information Discovery
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Command and Control
T1219 Remote Access Tools; T1572 Protocol Tunneling
Impact
Resource Development
Privilege Escalation
Affected products and versions in Hugging Face 'Load/Mine' Campaign
- Hugging Face — Hugging Face Hub model repositories / transformers trust_remote_code loading
Vulnerable versions: Any deployment loading untrusted repositories with trust_remote_code=True - Xorbits — Xinference
Vulnerable versions: Self-hosted servers that load malicious models; unauthenticated API exposure increases risk - GPUStack — GPUStack
Vulnerable versions: Self-hosted servers that load malicious models; container-to-host escape targeted /var/lib/gpustack - Microsoft — Windows (developer workstations targeted by fake Solana starter kit)
Vulnerable versions: Windows hosts running the README PowerShell one-liner
Remediation for Hugging Face 'Load/Mine' Campaign
Immediate actions
- Treat any host that loaded MENXIANGYU, wjsbg, soumikmahato, r1r13, hhzz667, dsxk4mr8tq, wssb123e, MONIADF-2, htt0118 or related qwen2-* repositories as fully compromised and rebuild it
- Hunt for /tmp/.cch/, /tmp/.cch/svc.py, /etc/cron.d/.sync-helper and svc.py references in /root/.bashrc, /root/.profile and user .bashrc
- Audit authorized_keys (root, xinference user, all users) for the ssh-ed25519 key commented qx-5090-op
- Block egress to 212.32.253.3, 8.137.187.63, 2.28.9.199, 38.55.133.49 and 212.132.98.170 and to the listed Pearl/Monero mining pool endpoints
- Grep process arguments for the pool login krxXJ2PKQW and look for a process named [kworker/u20:1] that is not a real kernel thread
- Rotate all credentials, API keys and tokens present on affected hosts
Workarounds
- Set trust_remote_code=False (the default) and prefer safetensors weights without custom Python modules
- Remove or quarantine downloaded model snapshots that contain auto_map entries pointing to .py files from untrusted repositories
- For the Solana kit, do not run PowerShell one-liners from README files; remove SolanaUpdateTools/solana-starter-kit clones and hunt for NetSupport Manager (client32.exe) installs and persistence
Longer-term hardening
- Require authentication on the Xinference API and limit its network reachability
- Review custom model code and pin the reviewed revision before loading any model with trust_remote_code
- Run untrusted model code with limited privileges, restricted network access and no production secrets
- Do not run model-serving containers privileged or with host disks/volumes mounted; isolate GPU inference hosts from production networks
- Mirror and allowlist approved models internally rather than pulling arbitrary repositories from Hugging Face or hf-mirror.com
- Monitor GPU utilization and outbound connections to mining pools on inference hosts
Weaknesses (CWE) in Hugging Face 'Load/Mine' Campaign
Timeline of Hugging Face 'Load/Mine' Campaign
- GitHub repository SolanaUpdateTools/solana-starter-kit created (November 2025; exact day not reported); it later accumulates 286 stars and delivers a NetSupport Manager RAT via a README PowerShell one-liner.
- First wave begins with a pure SSH-backdoor repository (qwen2-shell) on Hugging Face.
- Wave-one payload evolves into a fileless peakminer cryptominer running via memfd_create, with C2 at 8.137.187.63 (Alibaba Cloud).
- Six malicious repositories created within 2.5 hours, per Security Boulevard's summary of the Pluto report.
- Wave-two flagship MENXIANGYU/qwen2-tiny stands at 7,354 downloads; downloads climb rapidly within hours.
- MENXIANGYU/qwen2-tiny reaches 18,012 downloads; copycat htt0118/qwen2-tiny is uploaded.
- MENXIANGYU/qwen2-tiny reaches 28,412 downloads; second-wave repositories remain live despite reporting.
- Pluto Security publishes the 'Load/Mine' report and IOC guides; BleepingComputer reports the campaign, noting htt0118/qwen2-tiny and the Solana kit still live.
Sources cited for Hugging Face 'Load/Mine' Campaign
- Hugging Face malware campaign returns to hijack GPUs for crypto mining (BleepingComputer, Ax Sharma)
- Pluto Security: Hugging Face malware campaign 'Load/Mine' (primary report)
- Pluto Security Publishes a Full IOC Field Guide for the Hugging Face Qwen2 Miner Campaign
- Pluto Security Maps the Mining Engine and Backdoor Arsenal Behind the Hugging Face Campaign
- Pluto Security Traces a File Named 'modeling_evil.py' to a Full Hugging Face Mining Campaign (Security Boulevard)
- Pluto Security Details Load/Mine Cryptomining Campaign on Hugging Face (Unite.AI)
- Pluto Security details how a trust_remote_code download turns into malware (The Next Web)
Detection coverage for TL-2026-4776
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4776 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.