SeleniumGreed Campaign Exploits Exposed Selenium Grid to Deploy XMRig Miners
Summary
Wiz researchers detail an active campaign abusing exposed, unauthenticated Selenium Grid services to run remote commands and deploy XMRig miners, and recommend restricting access, enabling authentication, and monitoring workloads.
Key points
- The campaign targets publicly exposed Selenium Grid instances lacking authentication; researchers observed attacks against version 3.141.59 and confirmed remote-command execution is also possible on newer versions.
- Attackers abuse Selenium WebDriver options to run Python and establish a reverse shell, then create hidden scripts and download a modified XMRig miner.
- The campaign uses evasion tactics including disabling shell-history logging, timestomping files, packing the miner with custom UPX headers, and running processes with nohup.
- Researchers assess that compromised Selenium nodes are used to host payloads and proxy mining traffic; they believe the campaign has been active for over a year and report it is ongoing.
- Wiz recommends scanning for exposed services, restricting inbound and outbound network access, enabling Selenium Grid authentication, and using runtime detection.
Article Details
- Attack Vectors
- The campaign targets publicly exposed Selenium Grid services without authentication or adequate network controls, allowing remote interaction through the WebDriver API.
- For older Selenium versions, the attacker sets the Chrome binary path to /usr/bin/python3 and uses add_argument to execute a Python payload that opens a reverse shell.
- The attacker uses the shell to create and run a hidden script with sudo, download a modified XMRig miner and its launcher, and execute them.
- Defensive Notes
- Do not expose Selenium Grid to the internet; restrict inbound access to trusted IP ranges and outbound traffic to required endpoints.
- Enable basic authentication on Selenium Grid instances.
- Use external network and vulnerability scanners to identify exposed services, and runtime detection to identify exploitation and subsequent activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 164[.]90[.]149[.]104 | The article assesses this host as compromised and used to host payloads; the reverse-shell payload connects to it, and the host is also listed for payload hosting. |
| IPV4 | 165[.]22[.]195[.]35 | IP listed as a mining pool proxy for the campaign. |
| IPV4 | 165[.]227[.]63[.]241 | IP dynamically generated by the modified miner as its pool address; the article suspects it is a compromised host used as a mining pool proxy. |
| IPV4 | 192[.]241[.]144[.]69 | IP listed as C2 hosting infrastructure in the article's network indicators. |
| MD5 | 585fd7777074089aaa3c615169c18170 | MD5 hash listed for a campaign miner binary. |
| MD5 | 861f7deb8926bb0c6d11f8e81d27b406 | MD5 hash listed for a campaign miner binary; the article identifies the miner as modified XMRig. |
| SHA1 | 249d0f41d58fe90cf17bedc8d0c39c6c88e33251 | TLS fingerprint listed as a mining-pool communication indicator. |
| SHA1 | 47560b0a57913d01614256e9150b6e6f5e758250 | SHA-1 hash listed for a campaign miner binary. |
| SHA1 | b64cb7dbf62eb8b9539cc1d7901a487a3fd7de9b | SHA-1 hash listed for a campaign miner binary. |
| SHA256 | 6852b1102b0efc7ceb47520080fca57eb1a647c4e1c7ff3a40da9757c92ebaab | SHA-256 hash listed for a campaign miner binary. |
| SHA256 | d5aaa3b923dd8ede43e4cd9eea642d24f3d9be03273d5f97902bc615849af208 | TLS fingerprint listed as a mining-pool communication indicator. |
| SHA256 | fd5f076e99fd2ccb5f8aef5b4f69a8c2bf231808b2480f9d31955154a1509552 | SHA-256 hash listed for a campaign miner binary. |
| URL | hxxp[:]//164[.]90[.]149[.]104:9022/wxm | Payload URL used to download the script that runs the miner. |
| URL | hxxp[:]//164[.]90[.]149[.]104:9022/xm | Payload URL used to download the miner to /bin/xm. |
MITRE ATT&CK
T1027.002 · Software PackingThe modified XMRig miner is packed with UPX and custom CATS headers.T1059.004 · Unix ShellThe Selenium exploit runs Python to spawn a Bash reverse shell.T1070.006 · TimestompThe script changes the timestamps of /bin/xm and /bin/wxm using touch.T1105 · Ingress Tool TransferThe attacker downloads the miner and its launcher script from the compromised host.T1222.002 · Linux and Mac PermissionsThe attacker runs chmod 700 on /bin/xm and /bin/wxm.T1496 · Resource HijackingThe attacker deploys an XMRig miner to use the compromised machines' resources for cryptomining.T1562.003 · Impair Command History LoggingThe reverse-shell payload sets HISTFILE to /dev/null to disable interactive shell history logging.T1564.001 · Hidden Files and DirectoriesThe attacker creates a hidden, randomly named script under /tmp or /dev/shm.T1564.011 · Ignore Process InterruptsThe attacker uses nohup to keep the scripts and miner running after the reverse-shell session ends.T1584.004 · ServerThe article assesses that the attacker used a compromised server to host payloads and describes compromised Selenium nodes being used as infrastructure.
Malware
Vendors
Products
SeleniumWiz Research has detected an ongoing threat campaign that exploits exposed Selenium Grid services for cryptomining, dubbed “SeleniumGreed”. Selenium GridWiz Research has detected an ongoing threat campaign that exploits exposed Selenium Grid services for cryptomining, dubbed “SeleniumGreed”. Wiz Dynamic ScannerThe Wiz Dynamic Scanner detects publicly exposed Selenium services within customers' cloud environments. The Wiz agentless workload scanner detects containers and VMs hosting Selenium server. Wiz Runtime SensorThe Wiz Runtime Sensor detects events and behaviors associated with this threat and similar ones, alerting you as the adversary progresses through the attack kill chain: from the exploit and reverse shell to the initialWiz Threat Centerdetected by Wiz Runtime Sensor Wiz customers can use the pre-built queries and advisory in the Wiz Threat Center to search for vulnerable instances in their environment and detect if their environment was impacted