Crypto-mining worm steal AWS credentials

guest · Aug 17, 2020

Crypto-mining worm steal AWS credentials
TeamTNT has become the first crypto-minining botnet to include a feature that scans and steal AWS credentials
August 17, 2020
https://www.zdnet.com/article/crypto-mining-worm-steal-aws-credentials/

Security researchers have discovered what appears to be the first crypto-mining malware operation that contains functionality to steal AWS credentials from infected servers.
This new data-stealing feature was spotted in the malware used by TeamTNT, a cybercrime group that targets Docker installs.

The group has been active since at least April, according to research published earlier this year by security firm Trend Micro.
Per the report, TeamTNT operates by scanning the internet for Docker systems that have been misconfigured and have left their management API exposed on the internet without a password.

But in a new report published today, UK security firm Cado Security says the TeamTNT gang has recently updated its mode of operation.
Click to expand...

TEAMTNT NOW STEALS AWS CREDENTIALS
But while expanding its targets base is generally pretty important, Cado researchers said there's even a bigger update -- namely a new feature that scans the underlying infected servers for any Amazon Web Services (AWS) credentials.
Both of these files are unencrypted and contain plaintext credentials and configuration details for the underlying AWS account and infrastructure.

Nevertheless, when the attackers decide to do so, TeamTNT stands to seriously boost its profits, either by installing crypto-mining malware in more powerful AWS EC2 clusters directly or by selling the stolen credentials on the black market.
Click to expand...

Minimalist · Oct 5, 2020

Crypto-mining worm adds Linux password stealing capability

The TeamTNT cybercrime group has recently updated its crypto-mining worm with password-stealing capabilities and with an additional network scanner to make it easier to spread to other vulnerable devices.

While known mostly for actively targeting Docker instances to use compromised systems for unauthorized Monero (XMR) mining, the group now shifted their tactics by upgrading their cryptojacking malware to also collect user credentials.
Click to expand...

https://www.bleepingcomputer.com/ne...worm-adds-linux-password-stealing-capability/

Log in or Sign up

Crypto-mining worm steal AWS credentials

guest Guest

Minimalist Registered Member

Log in or Sign up

Crypto-mining worm steal AWS credentials

guest Guest

Minimalist Registered Member

Useful Searches