PyLoose Uses Python and Linux memfd to Run XMRig in Cloud Workloads

Jul 11, 2023 · Original article ↗

Summary

Wiz reports nearly 200 instances of PyLoose, a fileless attack that used exposed Jupyter Notebook services to run an XMRig miner in cloud workloads. The Python script loaded the miner into memory using Linux memfd.

Key points

Wiz says it first detected PyLoose on June 22, 2023, and observed close to 200 instances used for cryptomining.
The initial access involved a publicly accessible Jupyter Notebook service that allowed Python code to execute system commands.
The Python script fetched a compressed, encoded XMRig payload and ran it from memory using Linux memfd, avoiding writing the payload to disk.
The miner connected to an IPv4 address associated with the MoneroOcean mining pool; the article does not identify a specific threat actor.
Wiz recommends avoiding public exposure of Jupyter Notebook, using strong authentication such as MFA, and restricting system-command execution.
The article notes that detecting live memfd execution can involve checking whether /proc/{pid}/exe links to a path beginning with /memfd:.

Article Details

Attack Vectors: The attacker targeted a publicly accessible Jupyter Notebook service that allowed execution of system commands through Python modules such as os and subprocess.
The attacker downloaded the Python loader from a hosted URL into the Python runtime's memory, initially using wget and later making HTTPS GET requests in Python.
The loader decoded and decompressed an embedded XMRig payload and executed it from a Linux memfd memory-backed file without writing it to disk.
The XMRig payload connected to cryptocurrency mining pool endpoints for cryptomining.
Defensive Notes: Avoid publicly exposing Jupyter Notebook services.
Protect access with a complex password or security token, preferably through a centrally managed identity platform with MFA or other strong authentication.
Constrain system-command execution and other unrestricted execution paths.
Use runtime behavior analysis and memory monitoring to help detect fileless payloads.
Inspect /proc/{pid}/exe for a /memfd: prefix to identify live processes executed from memfd.
Use host-configuration scanning to identify publicly exposed Jupyter Notebook instances and runtime detection to monitor payload delivery, fileless execution, and cryptomining activity.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`gulf[.]moneroocean[.]stream`	Cryptomining pool endpoint listed as an indicator for the PyLoose activity.
DOMAIN	`pool[.]sabu-sabu[.]ml`	Cryptomining pool endpoint listed as an indicator for the PyLoose activity.
DOMAIN	`pool[.]xiao[.]my[.]id`	Cryptomining pool endpoint listed as an indicator for the PyLoose activity.
IPV4	`51[.]75[.]64[.]249`	Mining-pool network endpoint contacted by the XMRig payload.
MD5	`059f83f8969b09c29c95b17452718ea3`	MD5 hash identified as the XMRig payload.
MD5	`fec5b820594579f1088db47583d2c62d`	MD5 hash identified as the PyLoose loader.
SHA1	`d422493b47e4798717f2b05a482c97ef9e6b74b9`	SHA-1 hash identified as the PyLoose loader.
SHA1	`eba82ed21b329b0955ab87b2397a949628349b3f`	SHA-1 hash identified as the XMRig payload.
SHA256	`25232290fa9fa5529240a4e893ce206dfdcfc28d0b3a1b89389f7270f1046822`	SHA-256 hash identified as the PyLoose loader.
SHA256	`935ee206846223e6d2db3f62d05101c0bea741e7b43e1b73c1eb008f947d5ff1`	SHA-256 hash identified as the XMRig payload.
URL	`hxxps[:]//paste[.]c-net[.]org/chattingloosened`	URL used to host and deliver the PyLoose Python loader.