Tales From the Honeypot: WatchDog Evolves With a New Multi-Stage Cryptojacking Attack

MITRE Techniques

• [T1046] Network Service Scanning – The attackers used a scanning tool to enumerate large portions of the internet, looking for servers with port 2375 open. ‘the attackers used a scanning tool to enumerate large portions of the internet, looking for servers with port 2375 open.’
• [T1210] Exploitation of Remote Services – Initial access via misconfigured Docker Engine API endpoints and a Redis misconfiguration that enables remote code execution. ‘Initial access for this campaign was via misconfigured Docker Engine API endpoints’ and ‘a misconfigured Redis database that leaves it vulnerable to remote code execution.’
• [T1059.004] Unix Shell – The initial access command sequences run in shells (Alpine container) to fetch and execute payloads. ‘The malicious command first ensures cURL is installed on the Alpine container.’
• [T1053.003] Cron – Persistence and auto-start are achieved by scheduling cron jobs under root. ‘register a cron job under root, which will ensure that the first payload is kept running.’
• [T1070.006] Timestomp – The attack mods file times to evade detection and uses timestomping as an anti-forensics measure. ‘This method of timestamp manipulation is known as timestomping.’
• [T1564.001] Hide Artifacts – Process hiding and binary renaming to confuse analysts. ‘a very rudimentary (albeit effective) process hider’ and ‘rename the ps binary to ps.lanigiro.’
• [T1543.003] Create or Modify System Process – Linux Service – Persistence via a systemd service unit. ‘Persistence is achieved via a systemd service unit, requiring the user to be root in order to register it.’
• [T1036] Masquerading – Renaming common binaries to evade detection. ‘existence checks for renamed versions of the cURL data transfer utility.’