Monero miners target cloud-native development environments

Hackers behind the heist could be Russian

Bitcoin cryptocurrency mining

Security researchers have discovered a revival in attacks against GitHub and Docker Hub to mine cryptocurrency

According to researchers at cybersecurity firm Aqua Security, in just four days, the attackers set up 92 malicious Docker Hub registries and 92 Bitbucket repositories to abuse these resources for cryptocurrency mining. Last September, the team unearthed a similar campaign that exploited automated build processes on GitHub and Docker Hub to create cryptocurrency miners.

Researchers said hackers created a continuous integration process that initiates multiple auto-build processes every hour. On each build, a Monero cryptominer is executed.

In the attack, hackers created several fake email accounts using a free Russian email service provider. They then set up a Bitbucket account with a few repositories. To evade detection, each masqueraded as a benign project using the official project documentation.

Hackers then created a Docker hub with several registries. Each registry presented itself as benign, using its documentation to evade detection. The images are built on these service providers’ environments and then hijack their resources to mine cryptocurrency.

“This campaign shows the ever-growing sophistication of attacks targeting the cloud-native stack,” says Assaf Morag of Aqua Security. “Bad actors are constantly evolving their techniques to hijack and exploit cloud compute resources for cryptocurrency mining. It also reminds us that developer environments in the cloud represent a lucrative target for attackers as usually, they are not getting the same level of security scrutiny.”

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), told ITPro that the build systems used to create software should always be secured to ensure they only process requests related to legitimate projects. 

“There are many reasons for this, but the most important of which is to ensure that what is being built is something that should be built. When build systems and build processes are moved to cloud-based systems, the risk profile for the build system now extends to the capabilities of the cloud provider as well. While major public providers of software build services, like GitHub or Docker, will have protections in place to limit client risk, as this report shows, they are not immune from attack,” Mackey said.

Mackey added that this attack pattern should serve as an opportunity for anyone operating a cloud-based build process, not just the providers of such services. 

“If there is a way for unapproved code or configuration to enter your build system, then the actions performed by your build pipelines could be under the control of an attacker. Minimally, resource consumption could grow to a point where build jobs aren’t progressing as they should – a situation that could have a direct impact on delivery schedules,” he said.

Featured Resources

How to choose an AI vendor

Five key things to look for in an AI vendor

Download now

The UK 2020 Databerg report

Cloud adoption trends in the UK and recommendations for cloud migration

Download now

2021 state of email security report: Ransomware on the rise

Securing the enterprise in the COVID world

Download now

The impact of AWS in the UK

How AWS is powering Britain's fastest-growing companies

Download now

Recommended

Nigerian cyber criminals target Texas unemployment system
cyber security

Nigerian cyber criminals target Texas unemployment system

27 May 2021
Hackers use open source Microsoft dev platform to deliver trojans
Security

Hackers use open source Microsoft dev platform to deliver trojans

14 May 2021
NSA releases guidance on voice and video communications security
Voice over Internet Protocol (VoIP)

NSA releases guidance on voice and video communications security

18 Jun 2021
Ransomware criminals look to other hackers to provide them with network access
ransomware

Ransomware criminals look to other hackers to provide them with network access

17 Jun 2021

Most Popular

How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

16 Jun 2021
Q&A: Enabling transformation
Sponsored

Q&A: Enabling transformation

10 Jun 2021
Ten-year-old iOS 4 recreated as an iPhone app
iOS

Ten-year-old iOS 4 recreated as an iPhone app

10 Jun 2021