ScarletEel hackers have broken into the AWS cloud to steal credentials and intellectual property, perform cryptojacking, DDoS attacks, and more. AWS responds with a major update.
Researchers have observed ScarletEel hackers infiltrating Amazon Web Services (AWS) to steal credentials and intellectual property, install crypto mining software, perform distributed denial-of-service (DDoS) attacks, and more.
The hacker was first exposed in a February blog post by cloud security firm Sysdig. ScarletEel has proven to be proficient with AWS tools, so much so that it plugs into the cloud environment and uses native AWS functionality to move around with ease, performing a double whammy: installing crypto mining software and stealing intellectual property, too.
ScarletEel also continues to refine its tactics, managing to evade cloud security detection mechanisms and reach the AWS Fargate compute engine, according to the firm’s latest analysis. It has also expanded its arsenal by adding DDoS-as-a-service to its list of intrusion and exploitation techniques.
“So compared to their previous activity, we see that they are more aware of the victim environment and have improved their capabilities in terms of where to go, how to exploit it, and how to evade the defensive security measures that customers have already started to implement,” said Alessandro Brucato, a threat research engineer for Sysdig.
ScarletEel began its latest intrusion by exploiting Jupyter notebook containers in a Kubernetes cluster, then the attackers ran scripts to look for AWS credentials that they could send to their command-and-control (C2) server. Essentially, instead of using command-line tools, the scripts used shell built-ins. “This is a less visible way to exfiltrate data because curl and wget, which many tools monitor, are not being used,” the researchers noted.
ScarletEel also used Pacu, an open source tool for AWS, to discover a privilege escalation opportunity in the victim’s account. In parallel, it used Peirates, an equivalent tool to explore and exploit the victim’s Kubernetes environment.
To mask their activity, the attackers came up with an ingenious defense mechanism.
“Instead of dealing directly with AWS, they used a Russian server that supports the AWS protocol,” explains Michael Clark, director of threat research for Sysdig. The Living off the land attack with native AWS commands masks the maliciousness of the activity and simultaneously is not recorded in the victim’s AWS CloudTrail logs, because it all happened on the Russian site.
As Sysdig wrote in February, ScarletEel’s main goals are to steal proprietary software and perform cryptojacking.
Hackers recently abandoned 42 instances of crypto mining using a compromised account, which created so much noise that they were quickly detected and shut down, but the attackers were not deterred and even after being discovered, they still attempted to use other new and compromised accounts but failed due to lack of privileges.
Researchers estimated that if the attack had continued unabated, it would have yielded about $4,000 per day in cryptomining rewards.
In addition to IP theft and cryptojacking, the group also installed malware from the Mirai botnet family (Mirai is one of the most famous botnets in the world, which has been around since the mid-2010s) called “Pandora.” Researchers hypothesized that the hackers would have used Pandora-infected devices as a separate, larger part of a DDoS-as-a-service campaign.
“Regular” cloud security may not be enough for an attacker so comfortable in these environments. For example, in its most recent work, ScarletEel’s increased capabilities have allowed it to reach Fargate, AWS’s platform for running serverless containers.
Fargate is largely uncharted territory for both attackers and defenders because, Clark explains, “it’s often not publicly accessible. It’s used for a lot of internal and back-end purposes, and that means it’s not really seen as part of their attack surface.”
He adds, “But as we saw with this attack, they ended up on the Fargate system and took the credentials. So they’re definitely aware of the opportunity that’s there, and it’s just a matter of time before they get there.”
To protect against an entity like ScarletEel, Brucato explained, “you have to implement some measures to prevent attackers from getting into your environment. But if they can do that anyway—because they’re getting more sophisticated now—you also have to implement effective runtime security.” Clark emphasizes the value of effective cloud security posture management (CSPM) and cloud infrastructure entitlement management (CIEM).
“It’s not enough to just protect one way because attackers are really aware today,” Brucato concluded. “They can exploit any other detail.”
ScarletEel hackers have broken into the AWS cloud to steal credentials and intellectual property, perform cryptojacking, DDoS attacks, and more. AWS responds with a major update.
Researchers have observed ScarletEel hackers infiltrating Amazon Web Services (AWS) to steal credentials and intellectual property, install crypto mining software, perform distributed denial-of-service (DDoS) attacks, and more.
The hacker was first exposed in a February blog post by cloud security firm Sysdig. ScarletEel has proven to be proficient with AWS tools, so much so that it plugs into the cloud environment and uses native AWS functionality to move around with ease, performing a double whammy: installing crypto mining software and stealing intellectual property, too.
ScarletEel also continues to refine its tactics, managing to evade cloud security detection mechanisms and reach the AWS Fargate compute engine, according to the firm’s latest analysis. It has also expanded its arsenal by adding DDoS-as-a-service to its list of intrusion and exploitation techniques.
“So compared to their previous activity, we see that they are more aware of the victim environment and have improved their capabilities in terms of where to go, how to exploit it, and how to evade the defensive security measures that customers have already started to implement,” said Alessandro Brucato, a threat research engineer for Sysdig.
ScarletEel began its latest intrusion by exploiting Jupyter notebook containers in a Kubernetes cluster, then the attackers ran scripts to look for AWS credentials that they could send to their command-and-control (C2) server. Essentially, instead of using command-line tools, the scripts used shell built-ins. “This is a less visible way to exfiltrate data because curl and wget, which many tools monitor, are not being used,” the researchers noted.
ScarletEel also used Pacu, an open source tool for AWS, to discover a privilege escalation opportunity in the victim’s account. In parallel, it used Peirates, an equivalent tool to explore and exploit the victim’s Kubernetes environment.
To mask their activity, the attackers came up with an ingenious defense mechanism.
“Instead of dealing directly with AWS, they used a Russian server that supports the AWS protocol,” explains Michael Clark, director of threat research for Sysdig. The Living off the land attack with native AWS commands masks the maliciousness of the activity and simultaneously is not recorded in the victim’s AWS CloudTrail logs, because it all happened on the Russian site.
As Sysdig wrote in February, ScarletEel’s main goals are to steal proprietary software and perform cryptojacking.
Hackers recently abandoned 42 instances of crypto mining using a compromised account, which created so much noise that they were quickly detected and shut down, but the attackers were not deterred and even after being discovered, they still attempted to use other new and compromised accounts but failed due to lack of privileges.
Researchers estimated that if the attack had continued unabated, it would have yielded about $4,000 per day in cryptomining rewards.
In addition to IP theft and cryptojacking, the group also installed malware from the Mirai botnet family (Mirai is one of the most famous botnets in the world, which has been around since the mid-2010s) called “Pandora.” Researchers hypothesized that the hackers would have used Pandora-infected devices as a separate, larger part of a DDoS-as-a-service campaign.
“Regular” cloud security may not be enough for an attacker so comfortable in these environments. For example, in its most recent work, ScarletEel’s increased capabilities have allowed it to reach Fargate, AWS’s platform for running serverless containers.
Fargate is largely uncharted territory for both attackers and defenders because, Clark explains, “it’s often not publicly accessible. It’s used for a lot of internal and back-end purposes, and that means it’s not really seen as part of their attack surface.”
He adds, “But as we saw with this attack, they ended up on the Fargate system and took the credentials. So they’re definitely aware of the opportunity that’s there, and it’s just a matter of time before they get there.”
To protect against an entity like ScarletEel, Brucato explained, “you have to implement some measures to prevent attackers from getting into your environment. But if they can do that anyway—because they’re getting more sophisticated now—you also have to implement effective runtime security.” Clark emphasizes the value of effective cloud security posture management (CSPM) and cloud infrastructure entitlement management (CIEM).
“It’s not enough to just protect one way because attackers are really aware today,” Brucato concluded. “They can exploit any other detail.”