Monero miners target cloud-native development environments

Hackers behind the heist could be Russian

Bitcoin cryptocurrency mining

Security researchers have discovered a revival in attacks against GitHub and Docker Hub to mine cryptocurrency

According to researchers at cybersecurity firm Aqua Security, in just four days, the attackers set up 92 malicious Docker Hub registries and 92 Bitbucket repositories to abuse these resources for cryptocurrency mining. Last September, the team unearthed a similar campaign that exploited automated build processes on GitHub and Docker Hub to create cryptocurrency miners.

Researchers said hackers created a continuous integration process that initiates multiple auto-build processes every hour. On each build, a Monero cryptominer is executed.

In the attack, hackers created several fake email accounts using a free Russian email service provider. They then set up a Bitbucket account with a few repositories. To evade detection, each masqueraded as a benign project using the official project documentation.

Hackers then created a Docker hub with several registries. Each registry presented itself as benign, using its documentation to evade detection. The images are built on these service providers’ environments and then hijack their resources to mine cryptocurrency.

“This campaign shows the ever-growing sophistication of attacks targeting the cloud-native stack,” says Assaf Morag of Aqua Security. “Bad actors are constantly evolving their techniques to hijack and exploit cloud compute resources for cryptocurrency mining. It also reminds us that developer environments in the cloud represent a lucrative target for attackers as usually, they are not getting the same level of security scrutiny.”

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), told ITPro that the build systems used to create software should always be secured to ensure they only process requests related to legitimate projects. 

“There are many reasons for this, but the most important of which is to ensure that what is being built is something that should be built. When build systems and build processes are moved to cloud-based systems, the risk profile for the build system now extends to the capabilities of the cloud provider as well. While major public providers of software build services, like GitHub or Docker, will have protections in place to limit client risk, as this report shows, they are not immune from attack,” Mackey said.

Mackey added that this attack pattern should serve as an opportunity for anyone operating a cloud-based build process, not just the providers of such services. 

“If there is a way for unapproved code or configuration to enter your build system, then the actions performed by your build pipelines could be under the control of an attacker. Minimally, resource consumption could grow to a point where build jobs aren’t progressing as they should – a situation that could have a direct impact on delivery schedules,” he said.

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Mastering endpoint security implementation
Security

Mastering endpoint security implementation

16 Apr 2021
US, UK say Russia was behind SolarWinds hack
cyber attacks

US, UK say Russia was behind SolarWinds hack

16 Apr 2021
1Password targets enterprise customers with Secrets Automation
IT infrastructure

1Password targets enterprise customers with Secrets Automation

14 Apr 2021

Most Popular

University of Hertfordshire's entire IT system offline after cyber attack
cyber attacks

University of Hertfordshire's entire IT system offline after cyber attack

15 Apr 2021
Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021