Malicious Software Campaign Targets Insecure Kubernetes Clusters
A group of cybersecurity experts has issued a warning regarding an active malicious software campaign that is specifically targeting improperly configured Kubernetes clusters to illicitly mine Dero cryptocurrency.
Wiz, a cloud security company that uncovered the operation, revealed that it represents an enhanced version of a financially-driven scheme that was initially unveiled by CrowdStrike in March 2023, as per a previously published report.
“The unauthorized party exploited unrestricted access to a publicly accessible cluster on the internet to initiate harmful container instances sourced from Docker Hub, a few of which have amassed over 10,000 downloads,” stated Wiz researchers Avigayil Mechtinger, Shay Berkovich, and Gili Tikochinski in a published statement. “These Docker packages incorporate a UPX-encrypted DERO cryptocurrency miner dubbed ‘pause.’
To gain initial entry, the attackers targeted external Kubernetes API servers with anonymous credential access to distribute the cryptocurrency mining payloads.
Unlike the previous iteration in 2023, which utilized a Kubernetes DaemonSet labeled as “proxy-api,” the latest iteration employs seemingly innocuous DaemonSets named “k8s-device-plugin” and “pytorch-container” to ultimately operate the miner on all nodes within the cluster.
Moreover, the rationale behind assigning the container the moniker “pause” is an effort to mimic the official “pause” container that is utilized to begin a pod and enforce network separation.
The cryptocurrency mining software is a publicly available executable created in Go that has been adjusted to embed the wallet address and customized Dero mining pool URLs. Furthermore, it has been concealed using the publicly available UPX compression tool to avoid detection.
The objective is that by integrating the mining setup within the code, it facilitates the operation of the miner without necessitating any command-line arguments that are typically monitored by security systems.
Wiz also discovered additional utilities engineered by the culprit, including a Windows variant of a UPX-compressed Dero miner and a deployment shell script that is intended to halt rival mining processes on an infected machine and deploy GMiner from GitHub.
“The attacker has registered domains with harmless names to evade suspicion and seamlessly integrate into legitimate internet traffic, all the while masking communications with widely known mining pools,” remarked the researchers.
“These combined strategies showcase the attacker’s persistent drive to evolve their methodologies and outmaneuver defenders.”
About Author
