# Hugging Face 'Load/Mine' Campaign: Malicious Qwen2 Model Repos Abuse trust_remote_code to Hijack GPUs for Pearl (PRL) Mining and Backdoor Xinference/GPUStack Hosts

> At least 31 malicious Hugging Face repositories (plus a ModelScope mirror) abuse trust_remote_code and config.json auto_map so Python runs the moment a model loads, deploying the 'peakminer' cryptominer, reverse shells, SSH/cron persistence and a container-escape script against self-hosted Xinference and GPUStack GPU servers. A related fake Solana starter kit on GitHub delivers a NetSupport Manager RAT to Windows developers. Attributed to a financially motivated, Chinese-speaking operator.

- **Published:** 2026-10-29T22:22:42Z
- **Last reviewed:** 2026-10-29T22:22:42Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4776
- **ID:** TL-2026-4776
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Pluto Security's 'Load/Mine' report (published 2026-10-29) and BleepingComputer coverage describe a two-wave campaign distributed through fake small Qwen2 models on Hugging Face. Calling from_pretrained() with trust_remote_code=True imports a Python module named in the repository's config.json auto_map (for example modeling_evil.py, modeling_evil2.py, modeling_parasit.py), and its top-level code executes before the model class is even returned. The repositories carry a 42-byte decoy model.safetensors; the real payload is a packed binary (syscore.bin / sysx.bin) that is the 'peakminer' miner.

Wave one began on 2026-09-21 with a pure SSH-backdoor repository (qwen2-shell) and by 2026-09-22 had evolved into a fileless miner that runs from memory via memfd_create/fexecve, installed under /root/.xinference/cache and using C2 at 8.137.187.63 (Alibaba Cloud). Wave two, which reappeared within days of the first takedown, comprised 19 repositories across five accounts (MENXIANGYU alone had 13). The flagship MENXIANGYU/qwen2-tiny rose from 7,354 downloads on 2026-10-20 to 18,012 on 2026-10-25 and 28,412 by 2026-10-28; a copycat htt0118/qwen2-tiny was still live at publication. The report counts 29,818 campaign downloads (32,376 including 13 linked repositories).

The wave-two payload writes a watchdog (/tmp/.cch/svc.py) that relaunches the miner every 120 seconds and removes competing miners, appends launch hooks to /root/.bashrc, /root/.profile and user .bashrc files, installs cron persistence (/etc/cron.d/.sync-helper) and adds an ed25519 SSH key to authorized_keys in several locations including the xinference user's home. The miner process masquerades as the kernel thread [kworker/u20:1]; the packed binary's UPX markers were altered from 'UPX!' to 'PEK!' to hinder unpacking. A separate process connects a reverse shell to 212.32.253.3 on 443 or 9443 and retries after every disconnect; other components use a gsocket backdoor (212.132.98.170), a Cloudflare tunnel beacon, a gated stage served from 212.32.253.3:8898 (lf_py.py), and GPU/host metadata collection to 2.28.9.199:7000. Status reports to the operator are encoded as Xinference model-registry entries (qwen2-tiny-<base32>). A privileged container-escape script (qa-whl-1021) activates LVM volumes from inside a container, mounts candidate host disks and locates the host root or GPUStack's /var/lib/gpustack to gain root on the underlying host.

Payouts go to Pearl (PRL) wallets via Kryptex, LuckyPool and HeroMiners pools (Monero pools such as HashVault, MoneroOcean and c3pool also appear); the first-wave Pearl wallet had received about 2,276 PRL (~$5,000) across 716 transactions and mining continued after takedown. A shared pool login (krxXJ2PKQW.worker) appears across six analyzed wave-two builds. Nine machines of a research GPU cluster were observed mining simultaneously before jobs stopped about six minutes later, attributed to admin intervention. JFrog and Protect AI scanning did not flag the wave-two flagship, and JFrog noted it was 'not a machine-learning model'.

A related but distinct activity cluster: the GitHub repository SolanaUpdateTools/solana-starter-kit (created November 2025, 286 stars) tells developers to paste a PowerShell one-liner from the README that assembles a URL on developer-update.app and executes a script in memory, installing a NetSupport Manager RAT with C2 at maxwintodaybtc.com, persisting at login and showing a fake 'developer functionality temporarily paused' error. Air Security reported the kit; eSentire links the NetSupport operator to earlier fake TradingView 'AI signal' campaigns. The source does not state that the Solana kit and the Hugging Face miner share an operator.

Attribution is to a financially motivated, Chinese-speaking operator based on Simplified Chinese code comments, C2 on Alibaba Cloud and late-night China-timezone activity; no named actor or nation-state is asserted. No CVE is assigned: the abuse is of an intended-but-dangerous feature (trust_remote_code). Hosts that loaded these models should be treated as fully compromised because SSH-key and reverse-shell backdoors persist after miner removal. Severity HIGH is analyst-assigned. BeaconBeagle lookups for the C2 IPs returned no data (HTTP 404), so no C2 correlation is recorded.

## MITRE ATT&CK

- T1608.001 Upload Malware
- T1195.001 Compromise Software Dependencies and Development Tools
- AML.T0010.003 AI Supply Chain Compromise: Model
- T1204.002 Malicious File
- T1059.006 Python
- T1059.004 Unix Shell
- T1059.001 PowerShell
- T1053.003 Cron
- T1546.004 Unix Shell Configuration Modification
- T1098.004 SSH Authorized Keys
- T1611 Escape to Host
- T1036.005 Match Legitimate Resource Name or Location
- T1027.002 Software Packing
- T1620 Reflective Code Loading
- T1082 System Information Discovery
- T1572 Protocol Tunneling
- T1219 Remote Access Tools
- T1496.001 Compute Hijacking

## Sources

- [Hugging Face malware campaign returns to hijack GPUs for crypto mining (BleepingComputer, Ax Sharma)](https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/)
- [Pluto Security: Hugging Face malware campaign 'Load/Mine' (primary report)](https://pluto.security/blog/hugging-face-malware-campaign-load-mine/)
- [Pluto Security Publishes a Full IOC Field Guide for the Hugging Face Qwen2 Miner Campaign](https://www.finanzwire.com/press-release/pluto-security-publishes-a-full-ioc-field-guide-for-the-hugging-face-qwen2-miner-campaign-zDCEnMx0opA)
- [Pluto Security Maps the Mining Engine and Backdoor Arsenal Behind the Hugging Face Campaign](https://www.finanzwire.com/press-release/pluto-security-maps-the-mining-engine-and-backdoor-arsenal-behind-the-hugging-face-campaign-Vk7VOvLVnTX)
- [Pluto Security Traces a File Named 'modeling_evil.py' to a Full Hugging Face Mining Campaign (Security Boulevard)](https://securityboulevard.com/2026/10/pluto-security-traces-a-file-named-modeling_evil-py-to-a-full-hugging-face-mining-campaign/)
- [Pluto Security Details Load/Mine Cryptomining Campaign on Hugging Face (Unite.AI)](https://www.unite.ai/pluto-security-details-load-mine-cryptomining-campaign-on-hugging-face/)
- [Pluto Security details how a trust_remote_code download turns into malware (The Next Web)](https://thenextweb.com/news/pluto-security-hugging-face-trust-remote-code-cryptominer)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4776