A less-popular threat organization has become more active in the threat landscape over the past weeks by launching a new campaign targeting exploitable SSH servers with malicious payloads. Known primarily for their extensive technical knowledge and cryptojacking campaigns, the Diicot group (previously known as Mexals) is an organization that has been active since 2020 and have strong connections back to Romania. A unique characteristic of the Diicot group is their close alignment and similarities with the Romanian anti-terrorism unit, sharing similar messaging themes and imagery. Tactics and techniques employed by the group include intrusion method preferences alongside customized malware payloads and botnets. In their most recent campaign, Diicot threat actors have utilized brute-force scripts as their intrusion method against public-facing SSH servers with a very restrictive username and password combination list. This customized list only utilizes common, default, or easy-to-guess username and password combinations likely to target organizations with weak security posture. Additionally, Diicot will often employ the use of the popular communication platform Discord as a front for establishing and communicating with their command-and-control (C2) server(s) due to the capability of sending HTTP POST requests to a webhook URL in the platform. Lastly, Diicot also does a fair amount of doxing of other hackers throughout the threat landscape, specifically of their rival threat groups which appeared in a video hosted on Diicot servers, leaking several group member’s personal identifiable information. CTIX continues to track threat actor activity worldwide and will provide additional updates accordingly.