Key Takeaway
Darktrace identified a Chaos malware variant targeting misconfigured cloud deployments in October 2023. This new focus on cloud infrastructure marks a strategic pivot from traditional targets such as routers and edge devices.
What Happened
In October 2023, cybersecurity firm Darktrace identified a new variant of the Chaos malware actively exploiting misconfigured cloud deployments. Historically, this malware has targeted routers and edge devices, but the latest development indicates an expanded scope of infection. This new targeting was identified through an analysis of network activity and system logs during routine monitoring by the team at Darktrace.
The initial detection occurred following a spike in unusual traffic patterns emanating from compromised cloud environments. The botnet's evolution to include cloud resources represents a broader strategy by threat actors to increasingly exploit diverse infrastructures. This campaign is believed to be linked to a persistent group seeking to leverage cloud resources for greater computational power and potential anonymity.
Technical Details
Chaos primarily uses brute-force attacks on services hosted in poorly secured cloud environments. While the exact CVEs exploited remain unspecified, previous iterations targeted known vulnerabilities in router firmware and IoT devices using CVEs such as CVE-2023-28771 and CVE-2023-28773. With a focus on cloud deployments, it's likely that weakly configured SSH and RDP services are the primary vector.
The malware's persistence mechanisms include modifications to critical startup scripts on compromised servers, ensuring it reloads on reboot. For command and control (C2), Chaos uses peer-to-peer communication, making its network highly resilient against takedown efforts. Indicator of Compromise (IOC) details include high-volume traffic to known C2 domains and unexpected SSH login attempts from anomalous IP addresses.
Impact
Enterprises relying heavily on cloud services are the most at risk, especially those with inadequate security configurations. Organizations in sectors like finance and health, where sensitive data processing in the cloud is prevalent, could face significant repercussions from data breaches or service disruptions.
The expansion of Chaos's target base increases the risk for larger-scale attacks, potentially affecting thousands of organizations that utilize cloud hosting but might lack stringent security measures.
What To Do
- Review Cloud Configurations: Audit all cloud service configurations to ensure that only necessary services are exposed.
- Patch Regularly: Implement a robust patch management process to address vulnerabilities in cloud applications and infrastructure promptly.
- Strengthen Authentication: Enforce strong, multi-factor authentication for access to cloud resources.
- Monitor Network Traffic: Use advanced threat detection software to identify unusual patterns indicative of botnet activity.
- Educate Team Members: Provide training to IT staff on identifying and mitigating common cloud misconfiguration issues.
Routine network monitoring and a proactive security posture are essential in defending against evolving threats like Chaos. Focus on securing cloud configurations and maintaining vigilance to thwart these multifaceted attacks effectively.
Related:
Original Source
The Hacker News →Related Articles
Understanding the Masjesu Botnet: A Threat to IoT Security
Masjesu is a botnet targeting IoT devices for DDoS attacks, marketed on Telegram. It exploits weak IoT security, affecting various industries.
Atomic Stealer Exploits Script Editor in macOS Attack Campaign
Atomic Stealer malware targets macOS users via the Script Editor exploit, resembling ClickFix tactics. System updates and robust security measures are advised for mitigation.
Silent Skimmer: SVG-Based Credit Card Theft in Magento Stores
A massive cyber campaign has compromised nearly 100 e-commerce sites using Magento 1 by embedding credit card-skimming code within innocent-looking SVG files. Businesses must immediately migrate to supported platforms and enforce robust security protocols to protect consumer data.
In-Depth Analysis: Masjesu Botnet Targeting IoT Devices
The Masjesu botnet is an IoT-targeting malware deploying sophisticated persistence tactics for DDoS attacks. It exploits known IoT vulnerabilities to enlist devices in a C2 network, avoiding blacklisted IPs.