Monero miners target cloud-native development environments

Security researchers have discovered a revival in attacks against GitHub and Docker Hub to mine cryptocurrency

According to researchers at cybersecurity firm Aqua Security, in just four days, the attackers set up 92 malicious Docker Hub registries and 92 Bitbucket repositories to abuse these resources for cryptocurrency mining. Last September, the team unearthed a similar campaign that exploited automated build processes on GitHub and Docker Hub to create cryptocurrency miners.

Researchers said hackers created a continuous integration process that initiates multiple auto-build processes every hour. On each build, a Monero cryptominer is executed.

In the attack, hackers created several fake email accounts using a free Russian email service provider. They then set up a Bitbucket account with a few repositories. To evade detection, each masqueraded as a benign project using the official project documentation.

Hackers then created a Docker hub with several registries. Each registry presented itself as benign, using its documentation to evade detection. The images are built on these service providers’ environments and then hijack their resources to mine cryptocurrency.

“This campaign shows the ever-growing sophistication of attacks targeting the cloud-native stack,” says Assaf Morag of Aqua Security. “Bad actors are constantly evolving their techniques to hijack and exploit cloud compute resources for cryptocurrency mining. It also reminds us that developer environments in the cloud represent a lucrative target for attackers as usually, they are not getting the same level of security scrutiny.”

Tim Mackey, principal security strategist at the Synopsys CyRC (Cybersecurity Research Centre), told ITPro that the build systems used to create software should always be secured to ensure they only process requests related to legitimate projects. 

“There are many reasons for this, but the most important of which is to ensure that what is being built is something that should be built. When build systems and build processes are moved to cloud-based systems, the risk profile for the build system now extends to the capabilities of the cloud provider as well. While major public providers of software build services, like GitHub or Docker, will have protections in place to limit client risk, as this report shows, they are not immune from attack,” Mackey said.

Mackey added that this attack pattern should serve as an opportunity for anyone operating a cloud-based build process, not just the providers of such services. 

“If there is a way for unapproved code or configuration to enter your build system, then the actions performed by your build pipelines could be under the control of an attacker. Minimally, resource consumption could grow to a point where build jobs aren’t progressing as they should – a situation that could have a direct impact on delivery schedules,” he said.

Featured Resources

How to scale your organisation in the cloud

How to overcome common scaling challenges and choose the right scalable cloud service

Download now

The people factor: A critical ingredient for intelligent communications

How to improve communication within your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Improving cyber security for remote working

13 recommendations for security from any location

Download now