Several files were downloaded to our Struts2 honeypot from the Chinese repository site gitee.com for a user named "c-999. Around the same time, we observed similar activity pulling down files from a gitlab.com repository page for a user named "c-18. All the repositories had a folder called "ss" that contained 16 files. The files were a collection of ELF executables, shell scripts, and text files that execute a variety of actions, including achieving persistence and the execution of an illicit cryptocurrency miner. Once the threat actor had compromised a system, they achieved persistence on the device by installing a cron job that downloads and executes a file "logo.jpg" from "3389[.]space. This file is a shell script which, in turn, downloads mining executables from the threat actor's Git repositories and saves them under the filename "java. The exact file downloaded depends on the victim's system architecture