The story of this campaign is best told forward, because the dates show an operator that built its tooling in stages and then changed methods quickly. Pluto Security‘s timeline begins months before the first miner ran and ends with repositories still downloadable five days after the company reported them.
A long setup
The groundwork was laid on April 29, 2026, when the account hhzz667, listed as “hhzz svg,” was created. It sat dormant for five months, with no repositories, before its first deployment.
Four phases in a late-September push
The operation accelerated on September 21. Phase one, qwen2-shell, was 37 lines: a pure SSH backdoor that planted an ed25519 key in authorized_keys and beaconed to an Alibaba Cloud server in China. Its README was copied word for word from the official Qwen2.5-0.5B model card.
Phase two, on September 21 and 22, covered qwen2-tiny, -mini, -nano and -legacy at 102 lines. It added key injection in six paths, including the xinference user’s home, plus .bashrc injection. The code also dropped a self-test marker, /tmp/.qa_pwned, containing PWNED <hostname> uid=<uid>. The operator was QA-testing its own payload.
Phase three landed on September 22 as qwen2-final, at 305 lines. It was the first full fileless miner, with a kernel-thread disguise, a competing-miner killer, Xinference-based status reporting and dual pools, and it used clean names, Qwen2Config and modeling_qwen2.py.
Phase four came on October 12, on a throwaway account, dsxk4mr8tq, with the same code and updated URLs. It published six repositories within 2.5 hours. That is the account Pluto Security’s scanner caught, and it led to the rest of the campaign: the qwen2-tiny-lite repository held two forgotten backup loaders with older download URLs that pointed to hhzz667 on Hugging Face and wssb123e on ModelScope. The operator’s own version history connected the accounts. Comments throughout were in Simplified Chinese.
The takedown, and the second wave
Pluto Security reported the first wave to Hugging Face and ModelScope, and its timeline marks October 14 as the start of the takedown. At that point the first wave stood at 12 repositories across three accounts and two platforms, with more than 700 downloads recorded and no security flags. Both Hugging Face accounts and the ModelScope mirror were taken down.
A second wave followed within days: 16 repositories across four accounts, MENXIANGYU, wjsbg, soumikmahato and r1r13. The planted SSH key, which Pluto Security describes as one grep away from detection, gave way to reverse shells. A header comment in the wave-two payload references “report §9.1” and states that “ammunition must be self-hosted.” Repository-hosted binaries and mirrors continued from wave one. Pluto Security describes the change as the operator adapting to the takedown.
Disclosure, and a campaign that kept growing
Pluto Security’s timeline marks October 20 as the disclosure of the second wave, and the repositories stayed up. The flagship, MENXIANGYU/qwen2-tiny, grew from 7,354 to 9,584 downloads in the hours after disclosure, and the Hub listed it at 18,012 on October 25, five days later, with the repositories still live. That single model accounts for about 97% of the 18,544 second-wave downloads. With wave one and the linked models, the campaign totals 21,614 downloads.
The rest of the picture, in brief
The mechanics behind the timeline are consistent throughout. Delivery rides on trust_remote_code and an auto_map entry that imports repository Python, a surface where Pluto Security found nothing that analyzes what the code does. The flagship scanned clean, and none of the 12 first-wave repositories was flagged. The miners run fileless, disguise themselves as kernel threads and remove rival miners. The wave-two binary unpacks to peakminer once its altered UPX markers are restored. Persistence through SSH keys, cron, shell hooks and a watchdog outlasts the miner, and the r1r13 payload added GPU platform discovery for LLaMA-Factory and Tencent Cloud metadata collection. The first-wave payout wallet has received about 2,276 PRL, roughly $5,000, and was still earning after its repositories were removed. Pluto Security’s assessment is a financially motivated, Chinese-speaking operator or small group.
What the timeline shows
The through-line is iteration. Pluto Security counts more than 40 code iterations, with a 37-line SSH backdoor becoming a 305-line fileless miner in three weeks. An account sat dormant for five months, a throwaway published six repositories in 2.5 hours, and the second wave changed its access methods and payloads while keeping the same entry point. Pluto Security notes that the operator could replace listings and change access methods without changing the entry point. The controls it recommends are the ones that do not depend on a repository name: review the code, pin the reviewed revision and isolate the runtime.