Summary:[/subscribe_to_unlock_form]
Summary:[emaillocker id="1283"]
The first-ever Dero cryptojacking attack on Kubernetes infrastructure was found by researchers. Dero is a relatively new cryptocurrency that prioritizes privacy, and it uses directed acyclic graph (DAG) technology to guarantee total transaction anonymity. An existing Monero cryptojacking operation that was changed later in February 2023 is discovered to target a Dero cryptojacking operation. Before taking over the Kubernetes cluster, the updated Monero campaign removes the DaemonSets used for Dero cryptojacking.
Attackers meticulously selected the vulnerable Kubernetes clusters on non-standard ports by scanning and locating those that had authentication enabled, allowing anonymous access to the Kubernetes API. Attackers deployed their initial payloads and conducted scans using U.S.-based IPs. After interacting with the Kubernetes API initially, the attacker launches a Kubernetes Daemon Set that launches a malicious pod on each node of the Kubernetes cluster. This enables attackers to use all the nodes' resources simultaneously to conduct cryptojacking operations. The community pool receives the mining efforts from the pods and rewards them with Dero coins, which are then distributed equally among the donors via their online wallets.
Execution Flow
After the DaemonSet has deployed the pod, the script tries to execute a "pause" binary. Throughout this campaign, a community pool was deployed, which pays off for even the smallest contributions made in the connected digital wallet. In a legal Kubernetes deployment, Kubernetes bootstraps a pod using "pause" containers. To achieve this, a Docker image containing a "pause" binary—which is the Dero coin miner—is coordinated to execute by the DaemonSet's YAML file.
The actions of a financially motivated cryptojacking actor appear to clarify the campaign's objective, which is that the attackers are just attempting to mine for Dero. Researchers discovered a second, updated Monero effort that is aware of the Dero campaign, targets the same attack surface, but employs a more sophisticated strategy. The two campaigns are competing to locate undiscovered Kubernetes attack surfaces.
Threat Profile:
| Tactic | Technique Id | Technique |
| Reconnaissance | T1595 | Active Scanning |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Persistence | T1133 | External Remote Services |
| Defense Evasion, | T1610 | Deploy Container |
| Credential Access | T1552 | Unsecured Credentials |
| Command and Control | T1571 | Non-Standard Port |
| Impact | T1496 | Resource Hijacking |
References:
The following reports contain further technical details:
https://thehackernews.com/2023/03/new-cryptojacking-operation-targeting.html
[/emaillocker]