UnclassifiedUnknown

Returned Libra

Returned Libra is a threat actor group, tracked by Brandefense.

Also known as

8220 Mining Group

Techniques: 0
Exploited CVEs: No CVE data
First seen: Jan 1, 2017
Record updated: Oct 9, 2026

Vulnerabilities Linked To Their Tools.

CVE-2025-32432Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.Exploitedcritical CVE-2026-10520Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote…Exploitedcritical CVE-2021-40870Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.Exploitedcritical CVE-2024-50603Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code.Exploitedcritical CVE-2025-3248Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted…Exploitedcritical CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.Exploitedcritical CVE-2026-42271BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary…Exploitedhigh CVE-2026-105134A flaw has been found in Ahsay AhsayCBS up to 10.3.2.critical CVE-2018-21027Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.critical CVE-2024-46483Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacker-controlled content.critical CVE-2018-21028Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.high CVE-2026-105133A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.high CVE-2025-0283A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version…high

Arsenal · Malware And Tools.

XMRigmalware
GitHubtool
Monerotool

About Returned Libra.

Returned Libra, also known as 8220 Mining Group, is a cloud threat actor group that has been active since at least 2017. Tools commonly employed during their operations are PwnRig or DBUsed which are customized variants of the XMRig Monero mining software. The Returned Libra mining group is believed to have originated from a GitHub fork of the Rocke group's software. Returned Libra has elevated its mining operations with the use of cloud service platform credential scrapping.

Last updated Oct 9, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.