FlagThis - #cryptojacking

A widespread cryptojacking campaign is targeting misconfigured DevOps infrastructure, including Nomad, Consul, Docker, and Gitea, to illicitly mine Monero cryptocurrency. The attackers, tracked as JINX-0132, are exploiting known misconfigurations and vulnerabilities in publicly accessible web servers to deploy mining software. This campaign marks the first publicly documented instance of Nomad misconfigurations being exploited as an attack vector.

The JINX-0132 group uniquely avoids traditional identifiers, downloading tools directly from public GitHub repositories, including standard release versions of XMRig. This "living-off-open-source" approach complicates detection and clustering of their activities. They abuse insecure configurations and vulnerable software versions to hijack DevOps web servers.

HashiCorp Nomad and Consul, Docker API, and Gitea servers are being targeted. Affected Nomad instances can manage hundreds of clients, representing significant compute power. To prevent such attacks, organizations are advised to review their configurations, activate security features like access control lists (ACLs) for Nomad, and properly configure Consul to prevent unauthorized access and resource utilization.


References :

• The Hacker News: Cryptojacking Campaign Exploits DevOps APIs Using Off-the-Shelf Tools from GitHub
• www.scworld.com: Docker, HashiCorp, Gitea servers targeted in cryptojacking campaign
• Wiz Blog | RSS feed: DevOps Tools Targeted for Cryptojacking
• malware.news: Docker, HashiCorp, Gitea servers targeted in cryptojacking campaign
• The Register - Security: Illicit crypto-miners pouncing on lazy DevOps configs that leave clouds vulnerable
• securityaffairs.com: Cryptojacking campaign relies on DevOps tools
• www.csoonline.com: The high cost of misconfigured DevOps tools: Global cryptojacking hits enterprises
• www.it-daily.net: Cryptojacking campaign abuses DevOps APIs with GitHub tools
• Security Risk Advisors: Wiz Discovers JINX-0132 Cryptojacking Campaign Targeting Exposed DevOps Applications with Living-Off-Open-Source Strategy

Classification:

• HashTags: #Cryptojacking #DevOps #CloudSecurity
• Company: Multiple
• Target: DevOps infrastructure
• Product: Nomad, Consul, Docker, Gitea
• Feature: Web Servers
• Malware: XMRig
• Type: Malware
• Severity: Medium

Cybersecurity researchers are raising alarms about a new, sophisticated cryptojacking campaign called RedisRaider, which targets publicly accessible Redis servers running on Linux. Discovered by Datadog Security Labs, RedisRaider employs an aggressive and technically complex attack chain to deploy Monero miners on compromised systems. The malware uses a custom-built scanner to identify vulnerable Redis servers across the internet, exploiting weak configurations to execute malicious cron jobs that download and run the primary payload.

The attackers behind RedisRaider have implemented advanced techniques to evade detection and analysis. The malware is written in Go and heavily obfuscated using a tool called Garble, hiding key functions within the code. Additionally, RedisRaider employs anti-forensic measures such as short key time-to-live (TTL) settings to erase traces, writing temporary files to cron directories to blend with system processes, and deleting keys and logs after execution to cover its tracks. These tactics make it challenging for security professionals to detect and analyze the malicious activity.

Datadog's investigation uncovered that the same infrastructure used for the server-level attacks also hosted a web-based Monero miner, indicating a multi-pronged revenue generation strategy. The attackers generate income not only from hijacked Linux servers but also from unsuspecting website visitors. Experts emphasize the need for proper configuration and security measures for publicly accessible Redis servers, including strong authentication and access controls, to prevent RedisRaider and similar cryptojacking campaigns from compromising systems and stealing resources.


References :

• cyberpress.org: A newly discovered cryptojacking campaign, dubbed RedisRaider, is targeting publicly accessible Redis servers on Linux systems with an aggressive and technically complex attack chain.
• The Hacker News: Cybersecurity researchers are calling attention to a new Linux cryptojacking campaign that's targeting publicly accessible Redis servers.
• eSecurity Planet: New Go-Based Malware ‘RedisRaider’ Exploits Redis Servers to Mine Cryptocurrency
• Cyber Security News: New RedisRaider Campaign Attacking Linux Servers by Abusing Redis Configuration
• gbhackers.com: Datadog Security Research has uncovered a formidable new cryptojacking campaign dubbed “RedisRaider,” specifically targeting Linux servers with publicly accessible Redis instances.
• www.esecurityplanet.com: New Go-Based Malware ‘RedisRaider’ Exploits Redis Servers to Mine Cryptocurrency

Classification:

• HashTags: #Malware #Cryptojacking #RedisRaider
• Company: Redis
• Target: Linux Servers
• Attacker: Datadog Security Labs
• Product: Redis
• Feature: Misconfiguration Exploitation
• Malware: RedisRaider
• Type: Malware
• Severity: Medium