This Malware Has a Worrying Trick to Mine Monero on Cloud Servers

In an apparent first, a relatively new form of malware uninstalls security programs to avoid detection and mine crypto on cloud servers.

AccessTimeIconJan 18, 2019 at 12:00 p.m. UTC
Updated Sep 13, 2021 at 8:49 a.m. UTC

A recently observed form of malware uses a concerning new trick to avoid detection and mine cryptocurrency on cloud servers.

Two researchers, Xingyu Jin and Claud Xiao, from cybersecurity firm Palo Alto Networks, published a report on Thursday, saying that a nasty bit of software from bad actors dubbed the Rocke group is targeting public cloud infrastructure. Once downloaded, it takes administrative control to first uninstall cloud security products and then inject code that mines the monero cryptocurrency.

The researchers found that the Rocke malware injected code to uninstall five different cloud security products from infected Linux servers – including offerings from top Chinese cloud providers, Alibaba and Tencent. Adding insult to injury, the malware follows the uninstall steps set out in the products' user manuals.

To do its malicious work, the Rocke group exploits vulnerabilities in Apache Struts 2, Oracle WebLogic, and Adobe ColdFusion applications, and then downloads a shell script named “a7.” This knocks our rival crypto miners and conceals signs of its presence, as well as disabling the security programs.

The researchers add:

“To the best of our knowledge, this is the first malware family that developed the unique capability to target and remove cloud security products."

The Rocke group malware was first discovered by IT giant Cisco’s Talos Intelligence Group back in August. At the time Talos researcher David Liebenberg said that Rocke will “continue to leverage Git repositories to download and execute illicit mining onto victim machines.”

Back in November, research from Israel-based cybersecurity firm Check Point Software Technologies showed that a monero mining malware, dubbed KingMiner, is evolving through time to avoid detection.

Monero remains by far the most popular cryptocurrency among hackers. Last week, a study by college researchers showed that hackers have mined at least 4.32 percent of the total monero in circulation.

A study from McAfee, published in December, showed that instances of crypto-mining malware grew by over 4,000 percent last year.

Malware image via Shutterstock 

DISCLOSURE

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

The leader in news and information on cryptocurrency, digital assets and the future of money, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups. As part of their compensation, certain CoinDesk employees, including editorial employees, may receive exposure to DCG equity in the form of stock appreciation rights, which vest over a multi-year period. CoinDesk journalists are not allowed to purchase stock outright in DCG.

Trending

1
CoinDesk - Unknown
NFT Platforms Should Be Caught by EU Money-Laundering Overhaul, Lawmakers Say

Unhosted wallets and decentralized finance were left largely unscathed by two landmark crypto laws agreed to last week, but left-wing lawmakers may seek another go as they discuss dirty-money rules.

CoinDesk - Unknown
2
CoinDesk - Unknown
Bitcoin se recupera y supera los $19K; Nomura advierte de una recesión en EE. UU. y Reino Unido

Nomura escribió acerca de una recesión en la eurozona, el Reino Unido y Asia Pacífico, lo que podría influir en los precios de las criptomonedas.

CoinDesk - Unknown
3
CoinDesk - Unknown
Argentinos se refugian en stablecoins durante el fin de semana tras dimisión del ministro de Economía

Los principales exchanges del país informaron que los usuarios compraron hasta tres veces más criptomonedas estables que durante un fin de semana normal, en medio una crisis económica en ciernes.

CoinDesk - Unknown
4
CoinDesk - Unknown
Polkadot Builder Parity Technologies Adds 3 Execs to Leadership Team

The new executives joining Parity are Eran Barak (COO), Peter Ruchatz (CMO) and Fahmi Syed (CFO)

CoinDesk - Unknown