Unit 42 researchers identify EleKtra-Leak, an automated campaign that targets exposed IAM credentials in public GitHub repositories to spin up AWS EC2 instances for cryptomining, and they used a HoneyCloud setup to monitor the operation and reveal rapid credential exposure and multi-region mining activity. The findings show how threat actors leverage cloud automation to expand cryptojacking, with 474 unique miners observed and Monero mining across various regions.
#EleKtraLeak #Monero
#EleKtraLeak #Monero
Keypoints
- EleKtra-Leak is an automated campaign that targets exposed AWS IAM credentials in public GitHub repositories for cryptomining operations.
- The operation spins up multiple EC2 instances across regions to conduct long-running Monero cryptomining.
-
MITRE Techniques
- [T1552.004] Cloud Credentials – The threat actor scanned public GitHub repositories for exposed AWS IAM credentials and used them to access cloud resources. Quote: “The threat actor also appeared to blocklist AWS accounts that routinely expose IAM credentials.”
- [T1567.002] Exfiltration to Cloud Storage – The payload was stored encrypted on Google Drive and decrypted upon download. Quote: “The payload was stored encrypted and then decrypted upon download.”
- [T1583] Acquire Infrastructure – The actor used semi-random IaC (Terraform) to replicate AWS infrastructure for mining operations. Quote: “We created a semi-random AWS infrastructure using IaC templates for Terraform, which is an IaC provisioning tool to manage and maintain cloud infrastructure.”
- [T1087] Account Discovery – AWS account reconnaissance was performed to gather cloud environment details. Quote: “Figure 3 shows that the threat actor starts by performing an AWS account reconnaissance operation.”
- [T1564] Hide Artifacts – The actor used a VPN to obscure their identity during automated operations. Quote: “the actor was using a virtual private network (VPN) and Google Drive-exported documents to deliver payloads.”
Indicators of Compromise
- [Domain] pool[.]supportxmr[.]com:443 – XMR mining pool domain used by miners
- [SHA256] 87366652c83c366b70c4485e60594e7f40fd26bcc221a2db7a06debbebd25845 – Encrypted document: Backup.tib
- [SHA256] 240fe01d9fcce5aae311e906b8311a1975f8c1431b83618f3d11aeaff10aede3 – Miner binary hash (Appworker)
- [SHA256] 2f0bd048bb1f4e83b3b214b24cc2b5f2fd04ae51a15aa3e301c8b9e5e187f2bb – EC2 user data configuration hash
- [Monero Wallet] 82sdgJwuAMTF6w76Q7KrN4jJL72v23gvf9K2favHYHKxCNP4UabmBsJMwAVGWDLYagW5UmykC2D1zaMoQegZLy2bF9ynM1E – Monero wallet address used for mining payouts
Read more: https://unit42.paloaltonetworks.com/malicious-operations-of-exposed-iam-keys-cryptojacking/