Saturday, February 8, 2025
Homecyber securityAMBERSQUID: Novel Cryptojacking Attack Leverages AWS Services

AMBERSQUID: Novel Cryptojacking Attack Leverages AWS Services

Published on

SIEM as a Service

Follow Us on Google News

Cryptojacking is a malicious cyberattack in which an attacker stealthily utilizes a victim’s computer or device to mine cryptocurrencies such as Bitcoin or Monero without the victim’s knowledge or agreement.

This usually entails infecting the victim’s PC with malware that mines using the victim’s processing power and resources. 

Security experts at the Sysdig Threat Research Team (TRT) recently uncovered a novel cloud-native cryptojacking attack dubbed “AMBERSQUID” that leverages AWS services.

Novel Cryptojacking Attack

Overlooked services in AMBERSQUID operation can cost victims over $10,000/day. AMBERSQUID exploits the cloud services without AWS resource approval, complicating the incident response by targeting multiple services.

AMBERSQUID was found by analyzing 1.7M Linux Docker images, revealing hidden malicious payloads.

AMBERSQUID attack chain (Source – Sysdig)

The initial container on Docker Hub led to a broader investigation, uncovering accounts initially using basic cryptominer containers before transitioning to AWS-specific services in this analysis.

Here below, we have mentioned all the active Docker Hub accounts:-

  • https://hub.docker.com/u/delbidaluan
  • https://hub.docker.com/u/tegarhuta
  • https://hub.docker.com/u/rizal91
  • https://hub.docker.com/u/krisyantii20
  • https://hub.docker.com/u/avriliahasanah
  • https://hub.docker.com/u/buenosjiji662
  • https://hub.docker.com/u/buenosjiji
  • https://hub.docker.com/u/dellaagustin582
  • https://hub.docker.com/u/jotishoop
  • https://hub.docker.com/u/krisyantii20
  • https://hub.docker.com/u/nainasachie
  • https://hub.docker.com/u/rahmadabdu0
  • https://hub.docker.com/u/robinrobby754

Deep exploration of delbidaluan/epicx reveals an attacker’s GitHub account housing Amplify app source code and mining scripts, employing multiple code versions for evasion.

The delbidaluan/epic container uses entrypoint.sh as ENTRYPOINT, with various images executing distinct scripts in the same format.

The initial script, amplify-role.sh, establishes the ‘AWSCodeCommit-Role,’ a role the attacker uses to grant permissions to AWS Amplify and other services.

Document
FREE Webinar

Live DDoS Attack Simulation

Attend the Live DDoS Website & API Attack Simulation webinar to gain knowledge on various types of attacks and how to prevent them.

AWS Services Exploited

Here below, we have mentioned all the AWS services that are exploited:-

  • AWS Amplify
  • Amazon ECS
  • AWS CodeBuild
  • AWS CloudFormation
  • Amazon EC2 Auto Scaling
  • Amazon SageMaker

Wallets Used

Here below, we have mentioned all the wallets used:-

  • Zephyr
  • Tidecoin
  • Verus
  • Monero
  • QRL
  • Bamboo

Cost to the Victim

In the below chart, costs to the victim were mentioned:-

Cost to the victim (Source – Sysdig)

CSPs like AWS offer diverse services beyond EC2, often overlooked due to limited visibility, but they, too, grant access to computing resources.

Monitor all CSP services for misuse, employ higher-level usage logging if needed, and respond swiftly to detect and contain threats like AMBERSQUID. 

At the moment, this threat targeted the AWS only, but it also underscores risks for other CSPs.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access

United Kingdom has reportedly ordered Apple to create a backdoor allowing access to all...

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...

Cybercriminals Target IIS Servers to Spread BadIIS Malware

A recent wave of cyberattacks has revealed the exploitation of Microsoft Internet Information Services...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

UK Pressures Apple to Create Global Backdoor To Spy on Encrypted iCloud Access

United Kingdom has reportedly ordered Apple to create a backdoor allowing access to all...

Autonomous LLMs Reshaping Pen Testing: Real-World AD Breaches and the Future of Cybersecurity

Large Language Models (LLMs) are transforming penetration testing (pen testing), leveraging their advanced reasoning...

Securing GAI-Driven Semantic Communications: A Novel Defense Against Backdoor Attacks

Semantic communication systems, powered by Generative AI (GAI), are transforming the way information is...