Cloud Hosting

A cybercrime group that has previously struck Docker and Kubernetes cloud environments has evolved to repurpose genuine cloud monitoring tools as a backdoor to carry out malicious attacks, according to new research.

"To our knowledge, this is the first time attackers have been caught using legitimate third party software to target cloud infrastructure," Israeli cybersecurity firm Intezer said in a Tuesday analysis.

Using software called Weave Scope, which is used as a visualization and monitoring tool for Docker and Kubernetes services, the TeamTNT threat actor not only mapped the cloud environment of their victims but also executed system commands without having to deploy malicious code on the target server explicitly.

Then last month, the crypto-mining gang updated their modus operandi to exfiltrate Amazon Web Services (AWS) logins by scanning the infected Docker and Kubernetes systems for sensitive credential information stored in AWS credentials and config files.

While their method of gaining initial foothold hasn't changed, what has been tweaked is the mode of gaining control over the infected host's infrastructure itself.

Although the ultimate goal of TeamTNT appears to be generating cash via cryptocurrency mining, numerous groups that have resorted to deploying cryptojacking worms are successful at compromising enterprise systems in part because of exposed API endpoints, making them an attractive target for cybercriminals.

It's recommended that Docker API endpoints are access restricted to prevent adversaries from taking control over the servers.

"Weave Scope uses default port 4040 to make the dashboard accessible and anyone with access to the network can view the dashboard. Similar to the Docker API port, this port should be closed or restricted by the firewall," the cybersecurity firm said.

See the rest here:
Cybercriminals Are Using Legit Cloud Monitoring Tools As Backdoor - The Hacker News