DERO Cryptojacking Campaign Adapts to Evade Kubernetes Defenses

Jun 7, 2024 · Original article ↗

Summary

Wiz details an active DERO cryptojacking campaign abusing exposed Kubernetes APIs with overly permissive anonymous access. Attackers deployed disguised, packed miners with embedded wallet and pool data; the report provides technical findings, IOCs and mitigation advice.

Key points

Attackers gained access through externally accessible Kubernetes API servers where anonymous users had non-default permissions.
They deployed DERO miners in container images using names that mimic legitimate Kubernetes components and the standard pause container.
The UPX-packed miners contain encrypted wallet and mining-pool details, allowing them to run without suspicious command-line arguments.
A related script checks for competing miners, downloads different mining tools depending on GPU availability, and adds persistence while hiding execution evidence.
Wiz says the campaign remains active; Docker Hub removed two reported image-hosting accounts.
Wiz found no evidence of lateral movement from the Kubernetes cluster into the wider cloud environment in this incident.
Recommended safeguards include avoiding public cluster exposure, restricting anonymous permissions, and blocking untrusted container images.

Article Details

Attack Vectors: An Internet-facing Kubernetes API server had anonymous authentication enabled, and the anonymous user or group had non-default permissions that the attacker abused.
After verifying permissions, the attacker deployed cryptomining workloads across Kubernetes namespaces using malicious container images hosted on Docker Hub.
Related activity included a script that downloaded and executed mining binaries, including a binary from an attacker-controlled server.
Defensive Notes: Keep Kubernetes clusters private unless external access is necessary; disable anonymous authentication where possible and ensure anonymous users have only minimal permissions.
Use image-signature verification and registry-origin policies to block untrusted container images.
Monitor Kubernetes audit logs for actions by anonymous users and use runtime detections for suspicious processes and sustained high CPU utilization.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`community-pools[.]mysrv[.]cloud`	Mining pool domain used by some variants of the attacker's DERO miner.
DOMAIN	`d[.]windowsupdatesupport[.]link`	Attacker-added mining-pool subdomain recovered by decrypting strings in the miner.
DOMAIN	`h[.]windowsupdatesupport[.]link`	Attacker-added mining-pool subdomain recovered by decrypting strings in the miner.
DOMAIN	`name[.]windowsupdatesupport[.]link`	Attacker-added mining-pool subdomain recovered by decrypting strings in the miner.
DOMAIN	`update[.]windowsupdatesupport[.]link`	Listed as network infrastructure in the article's indicators of compromise.
DOMAIN	`windowsupdatesupport[.]link`	Domain the article says the attacker registered; active DNS queries were observed at the time of writing.
IPV4	`209[.]141[.]32[.]182`	Attacker-controlled server used to deliver a binary downloaded and executed by the dropper script.
MD5	`0576d33ec4bcd20966c3a24c210e0cad`	MD5 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
MD5	`14e7fb298049a57222254ef0f47464a7`	MD5 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
MD5	`207e358ed42fe1346213480f64a91442`	MD5 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
MD5	`22de8e4b08be5c2b1cc5eb2012739786`	MD5 of a malicious miner binary; the article also identifies this binary among those served by the attacker-controlled server.
MD5	`42e82a37cc6b44f7bc58c6ef6bf3e9e2`	MD5 of a Windows UPX-packed DERO miner sample.
MD5	`7c28e0727c74890b3998716967ab8339`	MD5 of the Linux dropper script ddns.sh.
MD5	`806b91c933e2202d5b6d836af9162e28`	MD5 of a Linux ARM malicious miner binary listed in the article's file-hash table.
MD5	`b6224dc51657a32e1aec1ca2a74c424a`	MD5 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
MD5	`cc47cb1bbef442d2f6aa7bc0b0843c88`	MD5 of a malicious miner binary; the article also identifies this binary among those served by the attacker-controlled server.
MD5	`eea6a4938a53eb5e4e254812b3f150c6`	MD5 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
SHA256	`06d080c816f099cccab56e4b596128e73cd63f524bdc2ddf5dd78c26f409f219`	SHA-256 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
SHA256	`49e8422e5f273a564c15755711ab2a35a1deb2105bbe1a0a8ce670c9b38721e5`	SHA-256 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
SHA256	`561790bd60258e056c72755bbaf848cfe5c3af548882c6a6579a599192bce3d2`	SHA-256 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
SHA256	`649a6fa70b26e5382652808348522b5e7f43f2f77a1b10a4cc5e5bfd5cb80327`	SHA-256 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
SHA256	`68656198c24d6b32c4916a5686906c62baf7d6baae3b1d7dc615e43cb6d3fca8`	SHA-256 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
SHA256	`9131aac1df4b3a610f5fe69c55fdc19f07055648c0081e61536eb903e0914dc2`	SHA-256 of a Windows DERO miner sample listed in the article's file-hash table.
SHA256	`ad2ee0040f88a9001a32f945ce15de2dd1126c0f9f6cb626f2de0163792d8ff7`	SHA-256 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
SHA256	`d6b14a4fbe5b9adbc0094098b4690ba5f5426247e21474915c408ca4553fcd49`	SHA-256 of a Linux ARM malicious miner binary listed in the article's file-hash table.
SHA256	`e1de787777faba85dcca4e10d945553aefdba14b1995cca7cf0721ee571c7e96`	SHA-256 of the Linux dropper script ddns.sh.
SHA256	`e4aa649015b19a3c3350b0d897e23377d0487f9ea265fe94e7161fed09f283cf`	SHA-256 of a Linux amd64 malicious miner binary listed in the article's file-hash table.
URL	`hxxp[:]//209[.]141[.]32[.]182/cloud`	Payload URL used by the dropper to download a binary from an attacker-controlled server.