Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks

guest · Sep 8, 2020

Hackers use legit tool to take over Docker, Kubernetes platforms
September 8, 2020
https://www.bleepingcomputer.com/ne...ool-to-take-over-docker-kubernetes-platforms/

In a recent attack, cybercrime group TeamTNT relied on a legitimate tool to avoid deploying malicious code on compromised cloud infrastructure and still have a good grip on it.

They used an opensource tool specifically created to monitor and control cloud environments with Docker and Kubernetes installations, thus reducing their footprint on the breached server.
Misusing tool of the trade
Analyzing the attack, researchers at Intezer discovered that TeamTNT installed Weave Scope open-source tool to gain full control of the victim’s cloud infrastructure.

According to them, this may be the first time a legitimate third-party tool is abused to play the part of a backdoor in a cloud environment, also indicating the evolution of this particular group.
Click to expand...

Weave Scope integrates seamlessly with Docker, Kubernetes, and the Distributed Cloud Operating System (DC/OS), and AWS Elastic Compute Cloud (ECS). It provides a complete map of processes, containers, and hosts on the server and control over installed applications.

“The attackers install this tool in order to map the cloud environment of their victim and execute system commands without deploying malicious code on the server,” Intezer notes in a report today.
Click to expand...

Intezer: Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks

TeamTNT is a cybercrime group that targets cloud environments including Docker and Kubernetes instances. The group has been previously documented using several tools including crypto-miners and Amazon Web Services (AWS) credential stealing worms.

TeamTNT has also been spotted using a malicious Docker image which can be found on Docker Hub to infect its victims’ servers. Now the group is evolving. In a recent attack observed by Intezer, TeamTNT uses a new technique by abusing Weave Scope, a trusted tool which gives the user full access to their cloud environment [...]
Click to expand...

Log in or Sign up

Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks

guest Guest

Log in or Sign up

Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks

guest Guest

Useful Searches