Aqua Shows Runtime Protection Against Sobolan Malware Targeting JupyterLab

Mar 10, 2025 · Original article ↗

Summary

Aqua researchers describe a Sobolan campaign that exploited unauthenticated JupyterLab, deployed cryptominers and persistence tools, and show how Aqua runtime policies detected and blocked activity while providing incident telemetry.

Key points

Attackers gained access through an unauthenticated JupyterLab instance and downloaded an archive containing 13 malicious files.
The scripts and binaries installed cryptominers, established persistence through cron jobs, and used evasion tactics.
One script modified .bashrc to present users with a fake login prompt; another inspected SSH credentials.
Aqua recommends configuring threat intelligence feeds, runtime policies, response policies, and alerts to detect and block malicious activity.
Aqua recorded 4,199 events from the workload, including 4 incidents, 138 blocked events, and 167 successful events that were not blocked by the Enforcer.

Article Details

Defense Focus: Detect and block cryptomining malware, persistence, and evasion in exposed interactive computing workloads using threat intelligence and runtime enforcement.
Detection Methods: Match runtime activity against custom IP address, DNS, and malicious-file-hash intelligence feeds and a continuously updated proprietary research feed.
Apply behavioral monitoring, drift prevention, rootkit detection, fileless-execution controls, and malware scanning.
Trigger response policies when malware is detected or selected behavioral rules match, with triggers scoped to specific images.
Correlate incidents from the same resource within a short interval; the investigation observed four incidents indicating intrusion and cryptominer execution.
Inspect runtime audit records to reconstruct process execution, file access, and blocked activity. The platform collected 4,199 events, including four incidents, 138 blocked events, and 167 successfully executed events.
Inspect suspicious binaries for inconsistencies between apparent network behavior and imported functions; the absence of PostgreSQL imports in syst3md suggested its apparent database connection might disguise mining-pool traffic.
Data Sources: Custom and proprietary threat intelligence feeds
Runtime incident records
Runtime audit events
File-opening and process-execution events
Blocked and successfully executed event records
Malicious shell scripts and binary imports
Cron configuration files
Rule Types: Runtime enforcement policies
Behavioral detection rules
Malware-triggered response policies
Image-scoped alert triggers
Platforms: Containers
Virtual machines
Cluster workloads
Defensive Actions: Require authentication for internet-accessible interactive computing environments and correct exposure-causing misconfigurations.
Add relevant malicious IP addresses, DNS indicators, and file hashes to custom threat intelligence feeds.
Configure container and virtual-machine runtime policies to block malicious execution.
Enable behavioral monitoring, drift prevention, rootkit detection, and fileless-execution controls.
Configure malware response policies and image-specific behavioral alert triggers.
Route alerts to operational applications or platforms for visibility and response.
Investigate clustered incidents using audit records, distinguishing blocked actions from actions that executed successfully.
Check for unauthorized shell startup modifications, cron entries, hidden payload directories, and cryptomining processes described in the attack.

Indicators of compromise

Type	Indicator	Context
IPV4	`167[.]172[.]154[.]218`	Download server hosting the malicious payload archive.
IPV4	`37[.]201[.]213[.]226`	Identified in the source IOC table as the attacker IP.
MD5	`0eba5ce29c4baf4888bd2a9dd39fec0a`	Source-reported MD5 of lol, a cryptominer-launching shell script whose execution was blocked.
MD5	`305f278eaf452f7e0b8d788e433278c6`	Source-reported MD5 of the pythonlol cryptominer.
MD5	`3242c1445baa1bb42418f534c468c817`	Source-reported MD5 of lol1, a shell script responsible for launching cryptominers.
MD5	`4b94b70a58413e83dd5fd937862ad6dd`	Source-reported MD5 of start, the main script that launches additional malicious scripts and binaries.
MD5	`6f2ad308cfca8ada83dddeff3550ff1b`	Source-reported MD5 of run, which renames its task to bash, inspects .ssh credentials, and executes another malicious binary.
MD5	`7849983d77b052de90558feeefb3078d`	Source-reported MD5 of the sobolan cryptominer.
MD5	`7989ea33ddede0ecf9f3e562aaa8a1c4`	Source-reported MD5 of status, a configuration-modifying file included among the malicious artifacts but not used in this attack.
MD5	`89599bf56ee19e0693a7ad5b57c7eeaf`	Source-reported MD5 of noob, which kills high-CPU processes, likely to reduce interference with cryptomining.
MD5	`9e39b0a7baca08a77c4716e5581660b2`	Source-reported MD5 of apachlogs, a malicious binary executed by run.
MD5	`a6ae2651f951fe07f265b548474274b9`	Source-reported MD5 of the binary named 1, which executes syst3md.
MD5	`ca1543264c990b85310bcb879e43eb36`	Source-reported MD5 of syst3md, a cryptominer whose apparent database connection may disguise mining-pool traffic.
MD5	`dac46d7fff94af972f02afc00fb5ee95`	Source-reported MD5 of crazy, which modifies ~/.bashrc to install a fake login prompt and restrict terminal access.
URL	`hxxp[:]//167[.]172[.]154[.]218/.sobo/temp.tar`	Payload download URL for the compressed archive containing 13 malicious files.