Silentbob Campaign: Cloud-Native Environments Under Attack

Cybersecurity scientists have unearthed an attack infrastructure that is staying utilized as part of a “likely huge campaign” against cloud-indigenous environments.

“This infrastructure is in early levels of screening and deployment, and is predominantly reliable of an aggressive cloud worm, built to deploy on uncovered JupyterLab and Docker APIs in buy to deploy Tsunami malware, cloud credentials hijack, source hijack, and even more infestation of the worm,” cloud security agency Aqua mentioned.

The exercise, dubbed Silentbob in reference to an AnonDNS domain established up by the attacker, is said to be joined to the notorious cryptojacking group tracked as TeamTNT, citing overlaps in strategies, tactics, and procedures (TTPs). Alternatively, it could be the function of an “sophisticated copycat.”

Aqua’s investigation was prompted in the aftermath of an attack focusing on its honeypot in early June 2023, foremost to the discovery of 4 destructive container photos that are intended to detect uncovered Docker and Jupyter Lab circumstances and deploy a cryptocurrency miner as perfectly as the Tsunami backdoor.

This feat is reached by suggests of a shell script that’s programmed to start when the container commences and is made use of to deploy the Go-primarily based ZGrab scanner to track down misconfigured servers. Docker has since taken down the pictures from the general public registry. The checklist of photos are below –

• shanidmk/jltest2 (44 pulls)
• shanidmk/jltest (8 pulls)
• shanidmk/sysapp (11 pulls)
• shanidmk/blob (29 pulls)

shanidmk/sysapp, apart from executing a cryptocurrency miner on the contaminated host, is configured to down load and run supplemental binaries, which Aqua claimed could both be backup cryptominers or the Tsunami malware.

Future WEBINAR🔐 Privileged Entry Management: Learn How to Conquer Critical Worries

Find out distinct techniques to conquer Privileged Account Administration (PAM) difficulties and stage up your privileged access security tactic.

Reserve Your Location

Also downloaded by the container is a file named “aws.sh.txt,” a script that is most likely intended to systematically scan the ecosystem for AWS keys for subsequent exfiltration.

Aqua said it found 51 servers with uncovered JupyterLab instances in the wild, all of which have been actively exploited or exhibited indicators of exploitation by threat actors. This contains a “stay handbook attack on 1 of the servers that utilized masscan to scan for uncovered Docker APIs.”

“At first, the attacker identifies a misconfigured server (either Docker API or JupyterLab) and deploys a container or engages with the Command Line Interface (CLI) to scan for and recognize supplemental victims,” security researchers Ofek Itach and Assaf Morag stated.

“This process is built to spread the malware to an rising quantity of servers. The secondary payload of this attack includes a crypto miner and a backdoor, the latter employing the Tsunami malware as its weapon of choice.”

Uncovered this article interesting? Stick to us on Twitter  and LinkedIn to examine far more special written content we write-up.

Some parts of this article are sourced from:
thehackernews.com