{
  "id": "loadmine-model-malware",
  "url": "https://ohshit.app/incidents/loadmine-model-malware/",
  "title": "Load/Mine research finds backdoors and cryptominers distributed as Hugging Face models",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-10-29",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Hugging Face",
    "AI models",
    "malware"
  ],
  "ecosystems": [
    "python",
    "ai"
  ],
  "summary": "Pluto Security reports malicious model repositories that execute Python before loading weights when custom code is permitted. The campaign returned after takedowns and left miners and backdoors. More than 32,000 recorded downloads are not confirmed infections or unique victims.",
  "splash": "GPU hosts, notebooks and CI that loaded the listed repositories with remote code enabled, or through tools that execute their custom Python",
  "wipe": "Contain exposed hosts, investigate persistence, replace reachable credentials and require reviewed pinned model code",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Identify model-code execution exposure",
      "hint": "Compare loading and cache logs with Pluto’s repository table, including MENXIANGYU/qwen2-tiny, htt0118/qwen2-tiny, wjsbg/qwen2-final and hhzz667/qwen2-final. Check whether trust_remote_code=True or an equivalent framework path imported publisher Python; a download or failed model initialization does not settle whether code ran."
    },
    {
      "title": "Contain and hunt across all related builds",
      "hint": "Pluto’s full table includes 14 account entries and more than ten host/network indicators; use its complete repository, wallet, path and hash lists, not just a single model name. Network destinations: 212.32.253.3:443/9443/8895/8898; 38.55.133.49:8901/9001; 8.137.187.63:80/443/50053/50054; 103.97.176.121:3361/8090/8899; 178.33.123.26:3361/3362; 2.28.9.199:7000; 173.249.209.96:8081/8000/8001; 212.132.98.170; 49.12.44.127; 200.58.80.115; hz2006.aihzcc[.]top; 3.112.174.116.sslip[.]io; grows-stocks-vatican-flood.trycloudflare[.]com; prl-us.kryptex[.]network:8048/7048; prl-sg.kryptex[.]network:8048; prl-eu.kryptex[.]network:7048; pearl-hk.luckypool[.]io:3361/3956; pearl-sg1.luckypool[.]io:3360; pool.hashvault[.]pro:80/443; de.pearl.herominers[.]com:1200; gulf.moneroocean[.]stream:10001; mine.c3pool[.]com:80. Inspect /tmp/.cch/, /tmp/.cchx, /tmp/.kitsd, /root/.xinference/cache, /etc/cron.d/.sync-helper, svc.py, [kworker/u20:1], shell startup files and SSH authorized_keys. The report also lists payload paths on huggingface.co, hf-mirror.com and modelscope.cn; do not block shared model hubs or mining pools indiscriminately. A match alone is not proof; missing one indicator does not establish safety. Preserve process, network, cache and startup evidence before cleanup."
    },
    {
      "title": "Remove backdoors and replace exposed secrets",
      "hint": "Isolate affected machines and restrict egress. Inspect SSH keys, cron, shell startup and model registrations; killing a miner or deleting a repository is insufficient. Rebuild from a trusted image if integrity cannot be established, then revoke or rotate accessible cloud tokens, passwords and SSH keys from a clean host. Review their recent use."
    },
    {
      "title": "Harden replacement inference environments",
      "hint": "Require Xinference API authentication and restrict reachability. Review custom Python, pin the reviewed revision, and disable remote-code loading where unnecessary. Run approved custom code without production secrets, with limited privileges and network access; clean scanner results do not prove publisher code is safe."
    }
  ],
  "sources": [
    {
      "name": "Pluto Security Load/Mine research",
      "url": "https://pluto.security/blog/hugging-face-malware-campaign-load-mine/",
      "says": "Primary payload analysis, victim-mining observations, indicators, containment and recovery guidance.",
      "primary": true
    },
    {
      "name": "BleepingComputer independent repository check",
      "url": "https://www.bleepingcomputer.com/news/security/hugging-face-malware-campaign-returns-to-hijack-gpus-for-crypto-mining/",
      "says": "Checked a surviving copied repository and confirmed miner/reverse-shell code; download totals originate from Pluto’s investigation.",
      "primary": false
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Pluto reports active victim mining and recovered backdoor payloads.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Sep 21, 2026",
      "title": "The first wave begins with SSH-key planting, according to recovered code"
    },
    {
      "date": "Oct 25, 2026",
      "title": "A new account uploads a near-identical second-wave payload"
    },
    {
      "date": "Oct 29, 2026",
      "title": "Pluto publishes the Load/Mine investigation and indicators"
    }
  ],
  "body_markdown": "Pluto published the investigation on October 29; the underlying activity began earlier. Custom model Python runs with the loading process’s privileges before weight initialization. This is abuse of permitted code execution, not proof that downloading any Hugging Face model compromises a host. Clean weight-format or antivirus scans do not validate that Python.\n\nThe researcher reports 31 malicious repositories in the core campaign, with additional linked models. The more-than-32,000 download figure is researcher-reported and unverified outside that investigation. It counts neither unique users nor confirmed infections. L4 reflects observed victim mining and backdoor deployment, rather than treating every download as a compromise.\n\nSome variants plant SSH keys, reverse shells or persistence beyond the miner. Treat their reachable credentials as exposed during response. Published takedowns do not remove malicious code or keys from machines that already ran it."
}