Threat Advisory

New Cryptojacking Campaign Leverages Misconfigured Redis Database Servers

Threat: Malware
Threat Actor Name: Watchdog and TeamTNT
Targeted Region: China and U.S.
Alias: Thief Libra, G0139, Adept Libra, TeamTNT
Targeted Sector: Technology & IT
Criticality: High
[subscribe_to_unlock_form]

Summary:

Researchers discovered a new cryptojacking campaign. The campaign is targeting insecure deployments of Redis, which is an open-source, in-memory data structure store used as a database, cache, and message broker. The attackers behind the campaign reportedly used transfer.sh, a free and open-source command-line file transfer service, as part of their attack infrastructure. They used this service to download a shell script, which they then used to download and execute a cryptocurrency-mining malware payload on the target systems. They gains initial access to their targets by exploiting an insecure deployment of Redis. Specifically, they were able to write a cron job to the Redis data store and force Redis to save the database file to one of the cron directories. When the cron scheduler reads files in the directory, it would execute the cron job, resulting in arbitrary command execution. This allowed the attackers to execute commands on the compromised system and download and execute the cryptocurrency-mining malware payload.[/subscribe_to_unlock_form]

Summary:

Researchers discovered a new cryptojacking campaign. The campaign is targeting insecure deployments of Redis, which is an open-source, in-memory data structure store used as a database, cache, and message broker. The attackers behind the campaign reportedly used transfer.sh, a free and open-source command-line file transfer service, as part of their attack infrastructure. They used this service to download a shell script, which they then used to download and execute a cryptocurrency-mining malware payload on the target systems. They gains initial access to their targets by exploiting an insecure deployment of Redis. Specifically, they were able to write a cron job to the Redis data store and force Redis to save the database file to one of the cron directories. When the cron scheduler reads files in the directory, it would execute the cron job, resulting in arbitrary command execution. This allowed the attackers to execute commands on the compromised system and download and execute the cryptocurrency-mining malware payload.[emaillocker id="1283"]

This campaign is designed to prepare the compromised system for efficient cryptocurrency mining. The malware starts with several preparatory actions, including disabling SELinux and configuring DNS requests to be resolved by public resolvers. Additionally, the malware removes existing cron jobs and the cron spool, which is a directory used by the cron scheduler to store and execute cron jobs. This is done to prevent any interference with the cryptocurrency mining process and to ensure that the malware has full control over the compromised system. After disabling SELinux, removing existing cron jobs, and freeing up RAM, the malware clears log files, configures iptables, kills competing miners, and installs additional packages. These actions are designed to maximize the system resources available for cryptocurrency mining and eliminate any competition that might interfere with the malware's mining activities. Once these preparatory actions have been completed, the malware retrieves the binaries for pnscan and XMRig. Pnscan is a port scanner used to identify vulnerable systems, while XMRig is the mining software used to mine cryptocurrency on the compromised system.

Although it is obvious that this campaign's goal is to use system resources to steal cryptocurrency, infection by this malware could have unforeseen consequences. Data corruption or a reduction in system availability could very easily come from the improper configuration of Linux memory management mechanisms. The majority of the time, cryptojacking is considered a minor cyberattack. Even so, the damage could be far bigger if something goes wrong with the low-level adjustments made to get the system ready for mining.

 

Threat Profile:

Tactics Technique Id Technique
Initial Access T1190 Exploit Public-Facing Application
Execution T1204 User Execution
T1059 Command and Scripting Interpreter
T1053 Scheduled Task/Job
Defense Evasion T1562 Impair Defenses
T1070 Indicator Removal
Lateral Movement T1210 Exploitation of Remote Services
Command and Control T1190 Ingress Tool Transfer
Impact T1496 Resource Hijacking
T1561 Disk Wipe

 

References:

The following reports contain further technical details:

https://thehackernews.com/2023/03/new-cryptojacking-campaign-leverages.html

[/emaillocker]
crossmenu