called the new fileless attack Pyrus Attackers have been observed attacking cloud workloads to deliver cryptocurrency miners, according to new findings from Wiz.
“The attack consists of Python code that loads XMRig Miner directly into memory using memfd, a fileless technology known in Linux,” said security researchers Avigayil Mechtinger, Oren Ofer, and Itamar Gilad. said. “This is the first publicly documented Python-based fileless attack targeting real cloud workloads.”
A cloud security firm announced that it has found nearly 200 instances of this attack technique being used to mine cryptocurrencies. Other details are unknown at this time, other than the fact that the threat actor has advanced capabilities.
In the infection chain documented by Wiz, initial access is achieved through exploitation of the publicly accessible Jupyter Notebook service, which allows execution of system commands using Python modules.
First detected on June 22, 2023, PyLoose is a Python script consisting of just 9 lines of code that embeds a compressed and encoded precompiled XMRig miner. The payload is taken from paste.c-net.[.]org is stored in the Python runtime’s memory by an HTTPS GET request without writing the file to disk.
The Python code is designed to decode and decompress the XMRig miner and load it directly into memory via the memfd memory file descriptor used to access memory resident files.
Shielding Against Insider Threats: Mastering SaaS Security Posture Management
Worried about insider threats? We’ve got you covered! Join us for this webinar to explore practical strategies and proactive security secrets using SaaS Security Posture Management.
join today
“By using open data-sharing services to host Python payloads, adapting fileless execution techniques to Python, and compiling XMRig miners to embed configurations, attackers can gain access to disks and use of exposed information. We have gone to great lengths to make it untraceable by circumventing the command line,” the researchers said.
The development comes as Sysdig details a new attack campaign launched by a threat actor known as SCARLETEEL that exploits AWS infrastructure to steal its own data and conduct illegal cryptocurrency mining. I was.
