Kubernetes RBAC Exploited in Large-Scale Campaign for Cryptocurrency Mining

A substantial-scale attack campaign found in the wild has been exploiting Kubernetes (K8s) Function-Centered Access Command (RBAC) to create backdoors and run cryptocurrency miners.

“The attackers also deployed DaemonSets to take about and hijack resources of the K8s clusters they attack,” cloud security organization Aqua explained in a report shared with The Hacker Information. The Israeli company, which dubbed the attack RBAC Buster, explained it found 60 uncovered K8s clusters that have been exploited by the menace actor powering this marketing campaign.

The attack chain commenced with the attacker gaining original access by means of a misconfigured API server, adopted by examining for proof of competing miner malware on the compromised server and then working with RBAC to established up persistence.

“The attacker developed a new ClusterRole with near admin-stage privileges,” the company reported. “Upcoming, the attacker produced a ‘ServiceAccount’, ‘kube-controller’ in the ‘kube-system’ namespace. And finally, the attacker created a ‘ClusterRoleBinding’, binding the ClusterRole with the ServiceAccount to generate a strong and inconspicuous persistence.”

In the intrusion observed in opposition to its K8s honeypots, the attacker tried to weaponize the exposed AWS entry keys to receive an entrenched foothold into the ecosystem, steal info, and escape the confines of the cluster.

The remaining step of the attack entailed the danger actor producing a DaemonSet to deploy a container image hosted on Docker (“kuberntesio/kube-controller:1..1”) on all nodes. The container, which has been pulled 14,399 periods considering that its add 5 months in the past, harbors a cryptocurrency miner.

Impending WEBINARZero Belief + Deception: Understand How to Outsmart Attackers!

Find out how Deception can detect superior threats, quit lateral movement, and boost your Zero Have confidence in system. Be part of our insightful webinar!

Conserve My Seat!

“The container image named ‘kuberntesio/kube-controller’ is a case of typosquatting that impersonates the legit ‘kubernetesio’ account,” Aqua reported. “The picture also mimics the common ‘kube-controller-manager’ container impression, which is a critical component of the control aircraft, running in a Pod on each and every learn node, responsible for detecting and responding to node failures.”

Apparently, some of the techniques explained in the campaign bear similarities to an additional illicit cryptocurrency mining operation that also took edge of DaemonSets to mint Dero and Monero. It really is at present not clear whether the two sets of attacks are connected.

Uncovered this posting interesting? Adhere to us on Twitter  and LinkedIn to read through more special content material we post.

Some parts of this article are sourced from:
thehackernews.com