DarkOwl Details Darknet Tactics Targeting Cloud Platforms
Summary
DarkOwl’s review of darknet discussions describes cloud-targeting tactics including phishing, credential stuffing, exposed API keys, SSRF, and Cloudflare bypass, alongside sales of cloud accounts and compromised access; forum claims are not independently verified.
Key points
- Darknet discussions described social engineering, SMS phishing, and credential stuffing as ways to target AWS and Azure accounts.
- Posts and listings offered AWS API keys, cloud accounts, and access to compromised servers; the article does not independently verify sellers’ claims.
- The article says exposed AWS keys have been found in public code repositories and that bots scan for them; it also relays users’ claims that AWS may detect leaked keys and notify account holders.
- SSRF against cloud-hosted applications can expose session or temporary IAM credentials through requests to metadata services; the article also describes risks involving third-party plugins and injection vulnerabilities.
- Darknet users discussed Azure DevOps and Team Foundation Server CVE-2019-1306 and Azure Stack CVE-2019-1234.
- Cloudflare bypass discussions covered origin-IP discovery using certificate data and subdomain enumeration; the article describes CloudFail as automating reconnaissance and subdomain scans.
- The article reports offers to use cloud resources for spam, phishing, exploit hosting, and stolen data.
Article Details
- Topic
- Darknet activity targeting cloud platforms, including account compromise, illicit access sales, and abuse of cloud resources
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//momoxia[.]selly[.]store/product/80806a1b | Specific seller-store page offering Google cloud accounts for sale. |
MITRE ATT&CK
T1078 · Valid AccountsAttackers used compromised cloud account credentials and API keys to access cloud environments.T1110.004 · Credential StuffingThe article describes automated credential-stuffing using reused compromised usernames and passwords.T1190 · Exploit Public-Facing ApplicationThe article describes exploiting server-side request forgery in web applications to access cloud credentials and escalate privileges.T1552.001 · Credentials In FilesAWS access keys were accidentally committed to repositories, which bots scanned for exposed credentials.T1566.002 · Spearphishing LinkTargeted SMS messages carried malicious links disguised as platform password-reset notifications to capture credentials.
CVE
CVE-2019-1234Earlier this year, Russian hackers on the darknet forum Dublikat discussed Azure Stack vulnerabilities documented in CVE-2019-1234 (Source: d25c98cc06300c5a8e3dcbd1a6ebf606).CVE-2019-1306A recent Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability” was explicitly posted to a hacker forum on the darknet by the user known by the moniker,
Threat Actors
badass888Sought help to hack an Azure-hosted server to access website databases and source code.BufferAdvertised access to an education institute’s cloud platform.m0rtemCreated CloudFail, a reconnaissance tool described as collecting target data and identifying origin servers behind Cloudflare.momxiaOffered Google accounts with cloud credit for sale, including through an online store.onfrichAdvertised access to Azure server panels belonging to a hospitality company.ProxyManiacIdentified PostNL subdomains in an activity the article describes as exploitation.RoxyPosted an iCloud bypass utility advertised for accessing personal iCloud accounts.scriptseller2018Advertised a script packaged for exploiting Apple ID and iCloud accounts.the-oneExpressed plans to buy an Office 365 phishing page for hosting on Azure.
Malware
Vendors
AmazonOur investigation includes a broad range of cloud environments; from compromising personal iCloud accounts to hacking large-scale infrastructures such as Microsoft Azure and Amazon Web Services (AWS).ApplePersonal Apple iCloud accounts are a popular target among darknet hackers.CloudflareAnother popular topic on the darknet is how to bypass “CloudFlare” website content delivery networks.GoogleGoogle CloudMicrosoftOur investigation includes a broad range of cloud environments; from compromising personal iCloud accounts to hacking large-scale infrastructures such as Microsoft Azure and Amazon Web Services (AWS).
Products
AWSOur investigation includes a broad range of cloud environments; from compromising personal iCloud accounts to hacking large-scale infrastructures such as Microsoft Azure and Amazon Web Services (AWS).AzureOur investigation includes a broad range of cloud environments; from compromising personal iCloud accounts to hacking large-scale infrastructures such as Microsoft Azure and Amazon Web Services (AWS).Azure DevOpsA recent Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability” was explicitly posted to a hacker forum on the darknet by the user known by the moniker,CloudflareAnother popular topic on the darknet is how to bypass “CloudFlare” website content delivery networks.Google DriveGoogle’s Cloud service “Google Drive” is also regularly targeted by threat actors on the darknet.iCloudOur investigation includes a broad range of cloud environments; from compromising personal iCloud accounts to hacking large-scale infrastructures such as Microsoft Azure and Amazon Web Services (AWS).JenkinsDarknet forum user, Everest_RR, started a thread discussing how CSRF exploitation could produce credentials and a starting point for server-attack through over 100 Jenkins plug-ins (Figure 7).Team Foundation ServerA recent Azure vulnerability, CVE-2019-1306, “Azure DevOps and Team Foundation Server Remote Code Execution Vulnerability” was explicitly posted to a hacker forum on the darknet by the user known by the moniker,
Tools
Industries
EducationIn the first example, threat actor Buffer is selling access to an education institute’s platform, which he claims gets 35 million visits per day.HospitalityIn the second example, threat actor onfrich is selling access to Azure server panels of a hospitality company.Sports bettingThe user, badass888, listed a number of “illegal sports betting” software websites that they wanted to replicate, but the threat actor needed to hack Azure’s cloud platform to gain access to the website databases and