The operators of a well-known cryptojacking malware targeting cloud servicesand added worm capabilitiesto make it easier to spread and harder for organizations to detect.
According to research by Palo Alto's Unit 42, the Rocke has updated the Pro-Ocean cryptojacking malware, which was used during 2018 and 2019 to illegally mine Monero from infected Linux.
Pro-Ocean consists of four modules, which serve different purposes: hiding malware, mining Monero, infecting more applications , and searching for and disabling other CPU-intensive processes so that the malware can steal Monero more efficiently.
The malware exploits known, old vulnerabilities in Apache Active MQ, Oracle WebLogic, Redis , and other cloud applications to deploy an XMRig miner in cloud environments. It can also be easily adapted to attack other applications .
Older versions of the cryptojacking malware were already able to search for and uninstall security cloud as well as disable any other potential cryptomining malware. Of course, the new version also has these capabilities, but also additional layers of concealment, which make it harder to detect.
“This malware is an example that demonstrates that cloud provider security solutions may not be enough to prevent malware targeting public cloud infrastructure,” writes Unit 42 senior researcher Aviv Sasson.
Additionally, this new version copies the malware to new locations and creates a new service that will run the malware if it is disabled.
As we mentioned above, its operators also added worm capabilities, using a Python script to find other machines on the same subnet.
The Rocke Group has been fairly quiet over the past year, but the updated cryptojacking malware suggests we're likely to see many more attacks.
“Cryptojacking malware targeting the cloud is evolving as attackers understand the potential of this environment for cryptocurrency,” he wrote. “We have seen simpler attacks from the Rocke Group in the past, but it appears that this group poses a continuing, growing threat.”
Source: SC Media
