Wiz Details Seven Summer 2023 Cryptomining Incidents Targeting Cloud Workloads

Sep 6, 2023 · Original article ↗

Summary

Wiz Research analyzed seven cloud cryptomining incidents from summer 2023, tracing access through exposed Jupyter notebooks and vulnerable Apache Solr and documenting miners, persistence, spreading, and detection opportunities.

Key points

Five incidents involved open Jupyter notebooks; two targeted publicly accessible Apache Solr 8.1.1.
The researchers observed XMRig, CCminer, and XMR-Stak-RX miners, alongside tools including tmate, PRoot, udocker, and ngrok.
In Kinsing activity, scripts disabled security measures, created cron persistence, searched for SSH credentials, and attempted to spread to other resources.
Solr attack commands ran under the service’s Java process. Wiz assessed exploitation as highly likely but ruled out Log4Shell based on the observed configuration; the specific exploit was not established.
Wiz found no evidence that a cryptominer was delivered in one Jupyter-related incident, though it documented tools and access methods associated with mining activity.
Wiz recommends identifying exposed notebooks and vulnerable Solr instances and using runtime monitoring to detect suspicious file access, payload execution, and mining-pool connections.

Article Details

Attack Vectors: Open Jupyter Notebooks allowing unauthenticated remote access were used for initial access in several incidents.
Attackers exploited an internet-accessible Apache Solr v8.1.1 instance in the Kinsing and z0Miner incidents; the specific vulnerability used was not determined.
Kinsing spread by searching infected hosts for SSH credentials and attempting to reach other resources over SSH.
Defensive Notes: Restrict Jupyter Notebook access to authenticated users and trusted sources; Wiz’s agentless host-configuration scanner can identify publicly exposed instances that allow unauthenticated access.
Identify and patch vulnerable, publicly exposed Apache Solr instances. Wiz describes combining agentless exposure and configuration data with runtime validation to help prioritize remediation.
Monitor for payload delivery, access to sensitive files such as shell history, execution of payloads absent from container images, and connections to cryptomining pools.
Investigate unexpected cron jobs, disabled security measures or logging, hidden directories under /tmp, and use of remote-access tools such as tmate or ngrok.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`vocaltube[.]ru`	Listed as a Kinsing command-and-control domain.
IPV4	`176[.]113[.]81[.]186`	Listed as a Kinsing miner-pool or pool-proxy IP.
IPV4	`185[.]122[.]204[.]197`	Listed as a Kinsing malware-hosting IP.
IPV4	`185[.]154[.]53[.]140`	Listed as a Kinsing command-and-control IP.
IPV4	`185[.]156[.]179[.]225`	Listed as a Kinsing miner-pool or pool-proxy IP.
IPV4	`185[.]221[.]154[.]208`	Listed as a Kinsing command-and-control IP.
IPV4	`185[.]87[.]48[.]183`	Listed as a Kinsing miner-pool or pool-proxy IP.
IPV4	`194[.]87[.]252[.]159`	Kinsing malware-hosting IP used to deliver scripts and other artifacts.
IPV4	`194[.]87[.]254[.]160`	Listed as a Kinsing miner-pool or pool-proxy IP.
IPV4	`31[.]184[.]240[.]34`	Kinsing malware-hosting IP used to deliver the kdevtmpfsi miner.
SHA1	`081ddbd9f39c21f1b9e1b5e1d58d7a9f5930a7f4`	SHA1 of akuh.zip, the archive containing PRoot and an archived filesystem used by the attacker.
SHA1	`0b97613c4c747f9f86d195fb6ead6c030bd21fee`	SHA1 of the CCminer cryptominer used in the incident.
SHA1	`0ceb8ffb0be23b808b534d744440f4367e17b9c5`	SHA1 of Kinsing malware.
SHA1	`1c47ea75acb66fece3464b3afba84b7ed8b13e5d`	SHA1 of run.sh, the script used to download and execute ngrok.
SHA1	`2a6b6c68d49fa5037bc3aa169ce3cfcc59b20518`	SHA1 of the renamed XMRig miner newhello.
SHA1	`31381d57d93b0c0738d2e92bce0014b69371f958`	SHA1 of tmate, which attackers used to maintain sessions on compromised resources.
SHA1	`430e3d3bb3a4ebf30b9345b8fc7a2a6cf69ba8a8`	SHA1 of solrd, the XMRig miner used by z0Miner.
SHA1	`4b75893b143d23ee720c1931281ebf1b14b03e8b`	SHA1 of spre.sh, the Kinsing script that searched for SSH credentials and attempted to spread over SSH.
SHA1	`555332faa336ed0e06e9b04d998cd53c5e192f1f`	SHA1 of the XMR-Stak-RX miner used in the incident.
SHA1	`5fc34a89d873a09b325adee825fbc869a2bc05b3`	SHA1 of solr.sh, the z0Miner initialization script that ensured the miner continued running.
SHA1	`6296e8ed40e430480791bf7b4fcdafde5f834837`	SHA1 of the UPX-packed kdevtmpfsi XMRig miner dropped by Kinsing.
SHA1	`8d53ade3599ca39d9ad22d9360834514e9a6c6dc`	SHA1 of root.sh, the script used to download and execute PRoot.
SHA1	`9aaa8f31807d6b5c953608f3dd61255adb2a62b9`	SHA1 of the PRoot tool used in the attacks.
SHA1	`a6e1414849d9ffa13ff49c6ba5a97ccc47b91051`	SHA1 of the z0Miner dropper script.
SHA1	`e691317c172593f0048113e590ae7b9f711a44ad`	SHA1 of cron.sh, the Kinsing script used to update cron jobs and kill other miners.
SHA1	`ed57d213d1e958d639a8de927ccbbcb431d72eae`	SHA1 of the kdevtmpfsi miner dropped by Kinsing.
SHA1	`ff8c38f871c789b000235a8f05ba5c936da8e6f1`	SHA1 of the initial Kinsing script, which disabled security measures, established persistence, and deployed malware.
URL	`hxxp[:]//175[.]118[.]126[.]65:8002/js/l.txt`	Malware-hosting URL used to deliver the z0Miner dropper script.
URL	`hxxps[:]//github[.]com/new43121/newhello/archive/refs/heads/main.zip`	Specific GitHub repository URL identified as hosting the attacker-delivered newhello miner.
URL	`hxxps[:]//raw[.]githubusercontent[.]com/akuhnet/wqemu/main/root.sh`	Specific URL for the script used in the attack to download and execute PRoot.