Summary:
Researchers discovered a new cryptojacking campaign. The campaign is targeting insecure deployments of Redis, which is an open-source, in-memory data structure store used as a database, cache, and message broker. The attackers behind the campaign reportedly used transfer.sh, a free and open-source command-line file transfer service, as part of their attack infrastructure. They used this service to download a shell script, which they then used to download and execute a cryptocurrency-mining malware payload on the target systems. They gains initial access to their targets by exploiting an insecure deployment of Redis. Specifically, they were able to write a cron job to the Redis data store and force Redis to save the database file to one of the cron directories. When the cron scheduler reads files in the directory, it would execute the cron job, resulting in arbitrary command execution. This allowed the attackers to execute commands on the compromised system and download and execute the cryptocurrency-mining malware payload.[/subscribe_to_unlock_form]
Summary:
Researchers discovered a new cryptojacking campaign. The campaign is targeting insecure deployments of Redis, which is an open-source, in-memory data structure store used as a database, cache, and message broker. The attackers behind the campaign reportedly used transfer.sh, a free and open-source command-line file transfer service, as part of their attack infrastructure. They used this service to download a shell script, which they then used to download and execute a cryptocurrency-mining malware payload on the target systems. They gains initial access to their targets by exploiting an insecure deployment of Redis. Specifically, they were able to write a cron job to the Redis data store and force Redis to save the database file to one of the cron directories. When the cron scheduler reads files in the directory, it would execute the cron job, resulting in arbitrary command execution. This allowed the attackers to execute commands on the compromised system and download and execute the cryptocurrency-mining malware payload.[emaillocker id="1283"]
This campaign is designed to prepare the compromised system for efficient cryptocurrency mining. The malware starts with several preparatory actions, including disabling SELinux and configuring DNS requests to be resolved by public resolvers. Additionally, the malware removes existing cron jobs and the cron spool, which is a directory used by the cron scheduler to store and execute cron jobs. This is done to prevent any interference with the cryptocurrency mining process and to ensure that the malware has full control over the compromised system. After disabling SELinux, removing existing cron jobs, and freeing up RAM, the malware clears log files, configures iptables, kills competing miners, and installs additional packages. These actions are designed to maximize the system resources available for cryptocurrency mining and eliminate any competition that might interfere with the malware's mining activities. Once these preparatory actions have been completed, the malware retrieves the binaries for pnscan and XMRig. Pnscan is a port scanner used to identify vulnerable systems, while XMRig is the mining software used to mine cryptocurrency on the compromised system.
Although it is obvious that this campaign's goal is to use system resources to steal cryptocurrency, infection by this malware could have unforeseen consequences. Data corruption or a reduction in system availability could very easily come from the improper configuration of Linux memory management mechanisms. The majority of the time, cryptojacking is considered a minor cyberattack. Even so, the damage could be far bigger if something goes wrong with the low-level adjustments made to get the system ready for mining.
Threat Profile:
| Tactics | Technique Id | Technique |
| Initial Access | T1190 | Exploit Public-Facing Application |
| Execution | T1204 | User Execution |
| T1059 | Command and Scripting Interpreter | |
| T1053 | Scheduled Task/Job | |
| Defense Evasion | T1562 | Impair Defenses |
| T1070 | Indicator Removal | |
| Lateral Movement | T1210 | Exploitation of Remote Services |
| Command and Control | T1190 | Ingress Tool Transfer |
| Impact | T1496 | Resource Hijacking |
| T1561 | Disk Wipe |
References:
The following reports contain further technical details:
https://thehackernews.com/2023/03/new-cryptojacking-campaign-leverages.html
[/emaillocker]