First Malware Targeting AWS Lambda Serverless Platform Discovered

News

A first-of-its-kind malware targeting Amazon Web Services’ (AWS) Lambda serverless computing platform has been discovered in the wild.

Dubbed “Denonia” after the name of the domain it communicates with, “the malware uses newer address resolution techniques for command and control traffic to evade typical detection measures and virtual network access controls,” Cado Labs researcher Matt Muir said.

CyberSecurity

The artifact analyzed by the cybersecurity company was uploaded to the VirusTotal database on February 25, 2022, sporting the name “python” and packaged as a 64-bit ELF executable.

However, the filename is a misnomer, as Denonia is programmed in Go and harbors a customized variant of the XMRig cryptocurrency mining software. That said, the mode of initial access is unknown, although it’s suspected it may have involved the compromise of AWS Access and Secret Keys.

Another notable feature of the malware is its use of DNS over HTTPS (DoH) for communicating with its command-and-control server (“gw.denonia[.]xyz”) by concealing the traffic within encrypted DNS queries.

CyberSecurity

However, “python” isn’t the only sample of Denonia unearthed so far, what with Cado Labs finding a second sample (named “bc50541af8fe6239f0faa7c57a44d119.virus“) that was uploaded to VirusTotal on January 3, 2022.

“Although this first sample is fairly innocuous in that it only runs crypto-mining software, it demonstrates how attackers are using advanced cloud-specific knowledge to exploit complex cloud infrastructure, and is indicative of potential future, more nefarious attacks,” Muir said.

Products You May Like

Articles You May Like

Data Breach at MC2 Data Leaves 100 Million at Risk of Fraud
Ireland’s DPC Hits Meta with €91 Million Penalty for GDPR Violation
Progress Software Releases Patches for 6 Flaws in WhatsUp Gold – Patch Now
Gamaredon’s operations under the microscope – Week in security with Tony Anscombe
Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023

Leave a Reply

Your email address will not be published. Required fields are marked *