Cybercriminals Target Alibaba Cloud for Cryptomining, Malware

guest · Nov 15, 2021

Cybercriminals Target Alibaba Cloud for Cryptomining, Malware
November 15, 2021
https://threatpost.com/cybercriminals-alibaba-cloud-cryptomining-malware/176348/

Cybercriminals are targeting Alibaba Elastic Computing Service (ECS) instances, disabling certain security features to further their cryptomining goals. Alibaba offers a few unique options that make it a highly attractive target for attackers, researchers noted.

According to research from Trend Micro, the Chinese giant’s cloud (also known as Aliyun) has a preinstalled security agent. While disabling security isn’t a new tactic, in this case the attackers are using a small piece of specific code in the cryptomining malware to create new firewall rules, instructing security filters to drop incoming packets from IP ranges belonging to internal Alibaba zones and regions.
Click to expand...

Typically, when cryptojacking malware is installed in an Alibaba ECS bucket, the security agent will send the user a notification that a malicious script is running. In this case, despite detection, “the security agent fails to clean the running compromise and gets disabled,” according to Trend Micro’s analysis, posted Monday.

“Looking at another malware sample shows that the security agent was also uninstalled before it could trigger an alert for compromise.”
Click to expand...

Cryptojackers Enter as Default Root Users
Targeting of Alibaba is on the rise thanks to a few unique features of the service, researchers noted, and the way that cloud instances can be configured.

“The default Alibaba ECS instance provides root access,” according to the analysis. “With Alibaba, all users have the option to give a password straight to the root user inside the virtual machine (VM).”
But in a default Alibaba ECS bucket, an attacker with stolen credentials or a working initial compromise exploit would enter with the highest possible privileges, researchers said. That opens the door to the deployment of advanced payloads such as kernel module rootkits and for establishing persistence via running system services.
Click to expand...

“Attackers can…easily replace the malicious cryptominer with another piece of malware that can potentially drive them more profit or spread to other workloads and endpoints,” they explained. “Subsequent attacks can be done on the projects or infrastructure as a result of how easy it is to infiltrate the environment with high user privileges.”

To protect themselves from threat actors stealing cloud resources, users should create a less privileged user for running applications and services within each Alibaba ECS instance, researchers recommended.
Click to expand...

Log in or Sign up

Cybercriminals Target Alibaba Cloud for Cryptomining, Malware

guest Guest

Log in or Sign up

Cybercriminals Target Alibaba Cloud for Cryptomining, Malware

guest Guest

Useful Searches