Mexals

Mexals, now known as Diicot, is a threat actor that has been active since at least 2021. This group exhibits extensive technical knowledge and pursues a wide variety of objectives. As a threat actor, Diicot may consist of an individual, a private company, or a government entity, all capable of executing actions with malicious intent. The cybersecurity industry has tracked this group's activities, highlighting its potential to pose significant threats. Recently, Cado researchers discovered an intriguing attack pattern associated with Diicot. The group's activities were detailed in analyses published by Akamai and Bitdefender. These reports shed light on the sophisticated techniques employed by Diicot, including the use of a Golang-based Secure Shell (SSH) worm module and a new LAN spreader for propagation. These advanced methods underline the group's technical prowess and adaptability. A few weeks prior to Cado's findings, Akamai unveiled details about a reinvigorated Romanian cryptojacking campaign led by Diicot. This campaign further illustrates the group's broad range of objectives and their continuous evolution in cybercriminal tactics. With these ongoing developments, it is clear that Diicot, previously known as Mexals, remains a prominent and evolving threat in the realm of cybersecurity.