Categories: Cryptocurrency hack

Cryptojacking Attack – Tesla Internal Servers Hacked to Mine Cryptocurrency

Tesla internal servers compromised by hackers and exposed the sensitive data from Tesla’s Kubernetes console that has been used for performing the cryptojacking attack.

Kubernetes is an open-source application used by large companies to manage API and server infrastructure and a tool used to automate the way a user deploys containerized apps.

Hackers took place in this unprotected Kubernetes console that was not protected with any password and stole sensitive data from the Testa’s owned Amazon s3 Bucket.

Also, an Attackers performed this Attack to deploy the crypto mining malware in one of Tesla’s Kubernetes pods.

Cryptojacking AttackCryptojacking Attack

Past few year Crypto currency mining is a very easy method for cybercriminals to Generating the huge revenue by hijacking the Web- browser and injecting the malicious script and taking control of the CPU Usage from the Victims.

Mining cryptocurrencies in a legitimate way are quite resource consuming process, so attackers demanding ransom payments and infecting other computers to mine the cryptocurrencies.

Hackers performed with sophisticated evasion measures to evade the detection by the security software.

Also Read: Biggest Crypto-Mining Campaign Ever – Hackers Mine $3 Million Worth of Monero Crypto-currency

Malicious script  used for Cryptojacking Attack

In this case, Instead of using public mining pool, hackers installed a mining pool software and inject the malicious script the public endpoints.

Since a Traditional security intelligence platform that focused standard IP/domain, its very difficult to detect this kind of malicious activities.

According to redlock Report, The hackers also hid the true IP address of the mining pool server behind CloudFlare, a free content delivery network (CDN) service. The hackers can use a new IP address on-demand by registering for free CDN services. This makes IP address based detection of crypto mining activity even more challenging.

Cybercriminals performed this attack with a non-standard port that usually difficult to detect its malicious activities.

According to the recent analysis, Tesla’s Kubernetes dashboard that CPU usage was not very high and researchers believe that hackers might be used a sophisticated evasion technique to maintain the CPU Usage low.

The RedLock CSI team immediately reported the incident to Tesla and the issue was quickly rectified. RedLock said.

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Russian Hacker Indicted Over $24 Million Qakbot Ransomware Operation

The U.S. Department of Justice has unsealed a federal indictment against Rustam Rafailevich Gallyamov, 48,…

30 minutes ago

Fortinet Zero-Day Under Attack: PoC Now Publicly Available

FortiGuard Labs released an urgent advisory detailing a critical vulnerability, CVE-2025-32756, affecting several Fortinet products,…

55 minutes ago

Global Crackdown Nets 270 Dark Web Vendors in Major Arrests

A sweeping international crackdown, codenamed Operation RapTor, has dealt a significant blow to the criminal…

2 hours ago

CISA Alerts on Threat Actors Targeting Commvault Azure App to Steal Secrets

On May 22, 2025, Commvault, a leading enterprise data backup provider, issued an urgent advisory…

2 hours ago

CefSharp Enumeration Tool Identifies Critical Security Issues in .NET Desktop Applications

Cybersecurity researchers and red teamers, a newly released tool named CefEnum is shedding light on…

14 hours ago

Russian Hackers Exploit Oracle Cloud Infrastructure to Target Scaleway Object Storage

Russian threat actors have been leveraging trusted cloud infrastructure platforms like Oracle Cloud Infrastructure (OCI)…

15 hours ago