TOPIC
Load/Mine campaign identity, malicious model-repository custom-code execution via trust_remote_code, GPU-mining/backdoor/persistence behaviors, post-takedown recurrence, model-hub scanning limits, realized victim denominator and actor attribution.
1
4
4
5
4
NEW — malicious Hugging Face/ModelScope model-repository campaign verified with custom Python execution, GPU mining, reverse-shell/persistence variants and post-takedown recurrence. Downloads do not equal infections; current repository state, realized victim denominator, universal scanner coverage and actor identity remain gated.
AI_MODEL_SUPPLY_CHAIN_MALWARE_TOPIC
—
—
—
Model repositories that can execute custom Python are software-supply-chain boundaries; model weights and repository identity alone are insufficient trust anchors.
Broader ecosystem measurements of custom-code loading paths
Removing the miner alone can be insufficient where campaign builds also establish SSH/reverse-shell access or startup persistence.
Host-level artifact/auth/network evidence
Repository/download counts do not establish malicious-code execution, persistence/backdoor success or unique victims.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Domains
الإجمالي: 4 Evidence
Pluto Security tracked malicious Hugging Face/ModelScope model repositories posing as Qwen2 test models. Custom repository Python executed during trusted remote-code loading to install GPU miners and, in variants, SSH/reverse-shell persistence; the campaign returned after takedowns.
لا يثبت: Does not prove download count equals infections, universal scanner failure, successful backdoor on every loader or definitive actor identity.
فتح Run المصدرBleepingComputer independently verified a near-identical live Hugging Face copy containing the miner and reverse shell, and reported second-wave reappearance, a container-escape script and observed mining activity while preserving downloads as exposure rather than confirmed infections.
لا يثبت: Does not independently prove ownership of all linked repositories, victim count or definitive attribution.
فتح Run المصدرHugging Face documents that trust_remote_code allows custom model-repository code to execute locally and should be enabled only for repositories whose code has been reviewed; revision pinning is recommended.
لا يثبت: Does not prove a flaw in intended opt-in semantics or automatic enablement by all downstream tooling.
فتح Run المصدرIndependent current-state review summarized campaign mechanics, distinguished safetensors weights from adjacent executable Python, reported one copy still listed on Nov 1 and found no public Hugging Face campaign statement at review time.
لا يثبت: Does not prove payload execution from every listed copy, complete campaign inventory or that no Hugging Face statement exists elsewhere.
فتح Run المصدرUnique loader/execution/persistence/IR telemetry
Security controls emphasizing weights, known malware or format hazards can miss malicious Python referenced by model configuration, as demonstrated in Load/Mine.
Controlled scanner-by-scanner coverage baseline
Load/Mine is operated by a financially motivated Chinese-speaking actor or small group.
Independent infra/wallet/account or authoritative attribution
Authoritative counts of unique loaders, malicious-code executions, miner installs, persistence/backdoor success, container escapes and affected organizations are unknown.
Hub/serving telemetry + endpoint process/auth/network evidence + IR outcomes normalized by repository/revision.
Complete authoritative inventory of remaining copies, replacement accounts, mirrors and current C2/mining infrastructure is not established.
Platform takedown inventory, repository/account graph, current passive infra and maintainer statement.
Operator identity and whether all campaign waves/linked repositories share one actor remain unproven.
Account-registration/infra/wallet linkage plus independent or authoritative attribution.
No controlled ecosystem-wide baseline quantifies which executable model-repository behaviors are detected or missed by current hub/partner scanners.
Controlled malicious-code corpus and scanner-by-scanner detection outcomes.
ACTOR_IDENTITY
SCANNER_COVERAGE_BASELINE
فتح Run