Soco404: Multiplatform Cryptomining Campaign | Wiz Blog

A sophisticated, ongoing cryptomining campaign dubbed Soco404 exploits misconfigured and vulnerable cloud services—particularly PostgreSQL—across Linux and Windows environments, using process masquerading, persistence techniques, and compromised legitimate infrastructure to distribute malware and embed itself within a broader crypto-scam operation.