Monero miners target cloud-native development environments

Hackers behind the heist could be Russian

Bitcoin cryptocurrency mining

Security researchers have discovered a revival in attacks against GitHub and Docker Hub to mine cryptocurrency

According to researchers at cybersecurity firm Aqua Security, in just four days, the attackers set up 92 malicious Docker Hub registries and 92 Bitbucket repositories to abuse these resources for cryptocurrency mining. Last September, the team unearthed a similar campaign that exploited automated build processes on GitHub and Docker Hub to create cryptocurrency miners.

Researchers said hackers created a continuous integration process that initiates multiple auto-build processes every hour. On each build, a Monero cryptominer is executed.

In the attack, hackers created several fake email accounts using a free Russian email service provider. They then set up a Bitbucket account with a few repositories. To evade detection, each masqueraded as a benign project using the official project documentation.

Hackers then created a Docker hub with several registries. Each registry presented itself as benign, using its documentation to evade detection. The images are built on these service providers’ environments and then hijack their resources to mine cryptocurrency.

“This campaign shows the ever-growing sophistication of attacks targeting the cloud-native stack,” says Assaf Morag of Aqua Security. “Bad actors are constantly evolving their techniques to hijack and exploit cloud compute resources for cryptocurrency mining. It also reminds us that developer environments in the cloud represent a lucrative target for attackers as usually, they are not getting the same level of security scrutiny.”

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), told ITPro that the build systems used to create software should always be secured to ensure they only process requests related to legitimate projects. 

“There are many reasons for this, but the most important of which is to ensure that what is being built is something that should be built. When build systems and build processes are moved to cloud-based systems, the risk profile for the build system now extends to the capabilities of the cloud provider as well. While major public providers of software build services, like GitHub or Docker, will have protections in place to limit client risk, as this report shows, they are not immune from attack,” Mackey said.

Mackey added that this attack pattern should serve as an opportunity for anyone operating a cloud-based build process, not just the providers of such services. 

“If there is a way for unapproved code or configuration to enter your build system, then the actions performed by your build pipelines could be under the control of an attacker. Minimally, resource consumption could grow to a point where build jobs aren’t progressing as they should – a situation that could have a direct impact on delivery schedules,” he said.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Recommended

Chipotle’s marketing email hacked to send phishing emails
phishing

Chipotle’s marketing email hacked to send phishing emails

29 Jul 2021
Colonial Pipeline hack spurred copycat attacks on other oil and gas companies
hacking

Colonial Pipeline hack spurred copycat attacks on other oil and gas companies

29 Jul 2021
Dark web ads offering access to corporate networks increase sevenfold
hacking

Dark web ads offering access to corporate networks increase sevenfold

28 Jul 2021
Number of hacking tools increasing as cyber criminals become more organized
hacking

Number of hacking tools increasing as cyber criminals become more organized

28 Jul 2021

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021