Full Report
Wiz Threat Research discovered a new variant of a cryptojacking campaign targeting misconfigured Kubernetes clusters in cloud environments. The threat actor abuses cluster anonymous access to deploy malicious container images from Docker Hub that contain a DERO miner. The thre...
Analysis Summary
# Tool/Technique: DERO Cryptojacking Variant
## Overview
This is a new variant of a DERO cryptojacking campaign discovered by Wiz Threat Research, specifically targeting misconfigured Kubernetes clusters in cloud environments. The primary goal is resource hijacking through the deployment of malicious container images containing a DERO miner.
## Technical Details
- Type: Malware family (Cryptominer variant)
- Platform: Kubernetes Clusters (Cloud Environments)
- Capabilities: Unauthorized deployment of containerized miners, evasion of detection via hardcoded configurations, neutralization of competing miners, and system log tampering.
- First Seen: Activity adapted since March 2023, current variant observed in 2024.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application
- T1190.002 - Cloud Service: Vulnerable Cloud Storage/Configuration (Specifically targeting misconfigured K8s API server access)
- **TA0002 - Execution**
- T1059.004 - Command and Scripting Interpreter: Unix Shell (Implied via container execution)
- T1608.002 - Stage Capabilities: Container Image (Deploying containers from Docker Hub)
- **TA0005 - Defense Evasion**
- T1027 - Obfuscated Files or Information (UPX packing, hardcoded encrypted wallet/pool info)
- **TA0008 - Lateral Movement**
- T1078.004 - Valid Accounts: Cloud Accounts (Abusing unauthorized K8s API access)
- **TA0011 - Command and Control**
- T1071.001 - Application Layer Protocol: Web Protocols (Communication with mining pools via updated domains)
- **TA0004 - Privilege Escalation**
- T1078.004 - Valid Accounts: Cloud Accounts (Exploiting non-default roles after initial access)
- **TA0003 - Persistence** (Implied through maintaining operational status)
## Functionality
### Core Capabilities
* **Initial Access:** Abusing publicly accessible Kubernetes API servers with anonymous authentication enabled to gain unauthorized, minimal permissions.
* **Deployment:** Utilizing legitimate-looking deployment names (`k8s-device-plugin`, `pytorch-container`) across multiple namespaces to host the miner.
* **Cryptomining:** Deploying a DERO miner packaged within malicious container images found on Docker Hub.
* **Resource Hijacking:** Using victim cloud compute resources for DERO mining.
### Advanced Features
* **Evasion by Configuration:** Hardcoding encrypted wallet addresses and mining pool URLs directly into the malware executable, bypassing need for suspicious command-line arguments.
* **Adaptability:** Updating Docker Hub images and registering new domains to maintain communication with mining pools and evade prior detection methods.
* **Competition Neutralization:** Employing a dropper script to neutralize competing cryptojacking activity already present on the target systems.
* **Log Tampering:** Modifying system logs (via the dropper script) to cover tracks.
## Indicators of Compromise
- File Hashes: Not specified in detail.
- File Names: Malicious container image named "pause" (mimicking legitimate K8s component) inside containers. Workload names like `k8s-device-plugin`, `pytorch-container`.
- Registry Keys: Not applicable (Linux/Container-based attack).
- Network Indicators: New or updated domains used for communication with DERO mining pools (Defanged structure required for summary: `[NEW-POOL-DOMAIN]`, `[UPDATED-POOL-SERVER]`).
- Behavioral Indicators: Anonymous K8s API server access, high CPU/resource utilization spikes correlating with container execution, creation of pods/deployments in unusual namespaces, unusual container image pulls from Docker Hub.
## Associated Threat Actors
- Unknown (Attribution pending, campaign shows adaptive behavior since March 2023).
## Detection Methods
- Signature-based detection: Should look for indicators related to the UPX-packed DERO miner binary, although packing complicates this.
- Behavioral detection: Monitoring for unusual API calls originating from anonymous identities, container runtime activity using suspicious images, and process execution patterns associated with mining software overlaid on benign container names.
- YARA rules: Potentially useful for detecting the specific DERO miner payload within the container layers, despite UPX packing.
## Mitigation Strategies
- **Prevention:** Disable anonymous access on the Kubernetes API server immediately. Enforce least privilege for all users and service accounts.
- **Hardening:** Implement strict admission controllers (like OPA/Kyverno) to restrict container image sources (only allow verified/internal registries). Regularly audit roles and cluster permissions.
- **Monitoring:** Enhance monitoring for unexpected resource consumption, especially CPU/GPU in K8s nodes, and API server activity volume from unauthenticated sources.
## Related Tools/Techniques
- Generic Cryptojacking Payloads (DERO Miner family).
- Use of legitimate-sounding deployment names to hide malicious workloads (common container abuse technique).
- Techniques involving dropper scripts to manage competition (often seen in mature malware operations).