New Migo Malware Targeting Redis Servers for Cryptocurrency Mining

A novel malware marketing campaign has been noticed targeting Redis servers for preliminary entry with the final target of mining cryptocurrency on compromised Linux hosts.

“This certain marketing campaign entails the use of a amount of novel process weakening approaches versus the facts shop itself,” Cado security researcher Matt Muir claimed in a technical report.

The cryptojacking attack is facilitated by a malware codenamed Migo, a Golang ELF binary that will come equipped with compile-time obfuscation and the capacity to persist on Linux equipment.

The cloud security enterprise reported it detected the marketing campaign after it identified an “strange sequence of instructions” targeting its Redis honeypots that are engineered to reduce security defenses by disabling the following configuration selections –

• secured-manner
• replica-go through-only
• aof-rewrite-incremental-fsync, and
• rdb-save-incremental-fsync

It really is suspected that these options are turned off in get to ship extra commands to the Redis server from external networks and facilitate foreseeable future exploitation without attracting much focus.

This stage is then followed by menace actors placing up two Redis keys, a person pointing to an attacker-managed SSH key and the other to a cron career that retrieves the destructive major payload from a file transfer provider named Transfer.sh, a procedure earlier spotted in early 2023.

The shell script to fetch Migo using Transfer.sh is embedded within just a Pastebin file that’s, in change, obtained utilizing a curl or wget command.

Persistence

The Go-dependent ELF binary, apart from incorporating mechanisms to resist reverse engineering, acts as a downloader for an XMRig installer hosted on GitHub. It is also liable for carrying out a collection of techniques to create persistence, terminate competing miners, and start the miner.

On top rated of that, Migo disables Security-Improved Linux (SELinux) and searches for uninstallation scripts for monitoring brokers bundled in compute situations from cloud suppliers these kinds of as Qcloud and Alibaba Cloud. It more deploys a modified edition (“libsystemd.so”) of a well-known person-manner rootkit named libprocesshider to conceal processes and on-disk artifacts.

It truly is value pointing out that these steps overlap with ways adopted by regarded cryptojacking teams like TeamTNT, WatchDog, Rocke, and threat actors related with the SkidMap malware.

“Curiously, Migo seems to recursively iterate as a result of data files and directories less than /etc,” Muir noted. “The malware will just go through data files in these places and not do something with the contents.”

“A person principle is this could be a (weak) endeavor to confuse sandbox and dynamic analysis options by accomplishing a large amount of benign steps, ensuing in a non-destructive classification.”

Yet another speculation is that the malware is looking for an artifact that is certain to a concentrate on natural environment, whilst Cado explained it found no evidence to aid this line of reasoning.

“Migo demonstrates that cloud-targeted attackers are continuing to refine their procedures and improve their capacity to exploit web-dealing with services,” Muir claimed.

“Despite the fact that libprocesshider is routinely made use of by cryptojacking campaigns, this distinct variant contains the capacity to cover on-disk artifacts in addition to the destructive procedures by themselves.”

Identified this report intriguing? Stick to us on Twitter  and LinkedIn to browse much more exclusive articles we write-up.

Some parts of this article are sourced from:
thehackernews.com