Cryptojacking is a malicious cyberattack in which an attacker stealthily utilizes a victim’s computer or device to mine cryptocurrencies such as Bitcoin or Monero without the victim’s knowledge or agreement.
This usually entails infecting the victim’s PC with malware that mines using the victim’s processing power and resources.
Security experts at the Sysdig Threat Research Team (TRT) recently uncovered a novel cloud-native cryptojacking attack dubbed “AMBERSQUID” that leverages AWS services.
Overlooked services in AMBERSQUID operation can cost victims over $10,000/day. AMBERSQUID exploits the cloud services without AWS resource approval, complicating the incident response by targeting multiple services.
AMBERSQUID was found by analyzing 1.7M Linux Docker images, revealing hidden malicious payloads.
The initial container on Docker Hub led to a broader investigation, uncovering accounts initially using basic cryptominer containers before transitioning to AWS-specific services in this analysis.
Here below, we have mentioned all the active Docker Hub accounts:-
Deep exploration of delbidaluan/epicx reveals an attacker’s GitHub account housing Amplify app source code and mining scripts, employing multiple code versions for evasion.
The delbidaluan/epic container uses entrypoint.sh as ENTRYPOINT, with various images executing distinct scripts in the same format.
The initial script, amplify-role.sh, establishes the ‘AWSCodeCommit-Role,’ a role the attacker uses to grant permissions to AWS Amplify and other services.
Attend the Live DDoS Website & API Attack Simulation webinar to gain knowledge on various types of attacks and how to prevent them.
Here below, we have mentioned all the AWS services that are exploited:-
Here below, we have mentioned all the wallets used:-
In the below chart, costs to the victim were mentioned:-
CSPs like AWS offer diverse services beyond EC2, often overlooked due to limited visibility, but they, too, grant access to computing resources.
Monitor all CSP services for misuse, employ higher-level usage logging if needed, and respond swiftly to detect and contain threats like AMBERSQUID.
At the moment, this threat targeted the AWS only, but it also underscores risks for other CSPs.
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
Paragon Software’s widely used Hard Disk Manager (HDM) product line has been found to contain five severe…
The Hertz Corporation has confirmed that sensitive personal information belonging to customers of its Hertz,…
Traditional passwords have been the cornerstone of digital security for six decades, but their reign…
A critical 0-day vulnerability has been disclosed in CentreStack, a popular enterprise cloud storage and…
Over 100,000 WordPress websites have been exposed to a critical security vulnerability, following the public…
A sophisticated cyberattack campaign has emerged, leveraging Microsoft Teams chats to infiltrate Windows PCs with…