Hackers target outdated versions of Linux in the cloud

Coinminers, web shells and ransomware, top malware aiming at Linux, report finds

Hackers are targeting old versions of Linux running in the cloud to take advantage of outdated software with unpatched vulnerabilities.

According to Trend Micro’s Linux Threat Report 2021 1H: Pervasive Security Issues in the Cloud, the cyber security firm detected over 15 million attacks in the first six months of 2021. The firm said that detections arose from systems running end-of-life versions of Linux distributions. Forty-four percent of the detections were from RHEL 7.8, followed by CentOS 6.4, which had almost 17% of the detections, and RHEL 7.7 with more than 10%.

The research looked at the top malware families affecting Linux servers during that six-month period. Web shells made up 29.61% of threats to Linux servers, with coinminers making up 29.45% of attacks, ransomware at 17.17.%, and PHP trojans at 14.34%.

Researchers said an interesting observation here is the high prevalence of web shells. The most detected web shell families are Backdoor.PHP.WEBSHELL.SBJKRW, Backdoor.PHP.WEBSHELL.SMMR; and cryptocurrency miners, where Coinminer.Linux.MALXMR.SMDSL64 and Coinminer.Linux.MALXMR.PUWELQ are the most prevalent families.

“Given that the cloud holds a seemingly endless amount of computing power, hackers have a clear motive in stealing computing resources to run their cryptocurrency mining activities. It’s also important to note that cryptocurrency miners have been plaguing container environments in recent years,” said researchers.

Related Resource

Cloud compute and storage performance analysis

Benchmark for IONOS Cloud Compute Engine

Title on a white background - whitepaper from IONOSDownload now

Researchers also saw ransomware as a prevalent Linux threat, with DoppelPaymer — a modern ransomware family that used double-extortion tactics — being the most prevalent family based on the company’s data. Researchers also saw other ransomware variants targeting Linux systems, such as RansomExx, DarkRadiation, and even DarkSide.

Even though there are an estimated 20,000 vulnerabilities reported in 2020 alone — many of which affect Linux or the Linux application stack — the report found only 200 of those vulnerabilities have publicly known exploits and were observed. Striving to prioritize the patching of these vulnerabilities should be baked into any organization's security practices, according to researchers.

“The applications affected by these 200 vulnerabilities have a few clear targets, including WordPress or Apache Struts, but services such as Atlassian JIRA, dnsmasq, and Alibaba Nacos aren't the first ones a security expert would automatically assume to be in attackers’ crosshairs,” researchers said.

Researchers said malicious actors would look for every opportunity to compromise the platform for financial gain — whether by developing and launching malware, exploiting vulnerabilities, or taking advantage of misconfigurations.

“Keeping Linux, the bedrock of critical systems and services, protected against threats can be achieved using a multilayered security approach: maximizing built-in tools and trusted commercial or free third-party security control,” they added.

Featured Resources

Shining light on new 'cool' cloud technologies and their drawbacks

IONOS Cloud Up! Summit, Cloud Technology Session with Russell Barley

Watch now

Build mobile and web apps faster

Three proven tips to accelerate modern app development

Free download

Reduce the carbon footprint of IT operations up to 88%

A carbon reduction opportunity

Free Download

Comparing serverless and server-based technologies

Determining the total cost of ownership

Free download

Recommended

US government warns of increased risk of ransomware over holiday season
ransomware

US government warns of increased risk of ransomware over holiday season

24 Nov 2021
Hackers use Linux backdoor on compromised e-commerce sites with software skimmer
malware

Hackers use Linux backdoor on compromised e-commerce sites with software skimmer

19 Nov 2021
Iranian hackers ramp up attacks against IT services sector
hacking

Iranian hackers ramp up attacks against IT services sector

19 Nov 2021
TikTok phishing campaign tried to scam over 125 influencer accounts
social media

TikTok phishing campaign tried to scam over 125 influencer accounts

18 Nov 2021

Most Popular

Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Apple's mixed reality headset could debut in 2022
augmented reality (AR)

Apple's mixed reality headset could debut in 2022

29 Nov 2021
Nike to take customers into the metaverse with 'NIKELAND'
virtualisation

Nike to take customers into the metaverse with 'NIKELAND'

19 Nov 2021