Cloudy With a Chance of Credentials | AWS-Targeting Cred Stealer Expands to Azure, GCP

MITRE Techniques

• [T1059.003] Unix Shell – The campaigns rely on Bash scripts (aws.sh, Data.sh) and show modular function design;
  Quote: “The script uses the cred_files function to search for credentials files on the system, write them to a temporary file …”
• [T1027.001] Obfuscated/Compressed Data – An embedded base64 blob is decoded to reveal a Bash script;
  Quote: “The main_main function decodes an embedded base64 blob, resulting in a Bash script that is written and then executed by the main_runCommand function.”
• [T1046] Network Service Scanning – The actor uses masscan and zgrab to identify vulnerable targets;
  Quote: “Masscan scans the specified IP ranges then passes the results to zgrab, which looks for misconfigured Docker daemons running version 1.16.”
• [T1105] Ingress Tool Transfer – The attacker downloads tooling from their server to install dependencies;
  Quote: “downloads the dependencies from the attacker’s server, hosted at the URI: /bin/[bin_name].”
• [T1071.001] Web Protocols – C2 communications and exfiltration use HTTP/S endpoints;
  Quote: “Exfil URL http[:]//everlost.anondns.net/upload.php”
• [T1041] Exfiltration Over C2 Channel – Exfiltration of collected cred data to an AnonDNS server;
  Quote: “The credentials stealing scripts use curl to exfiltrate the contents of the $CSOF file to an AnonDNS-hosted server.”
• [T1552.001] Credentials in Files – The campaign targets credential files across CSPs (Azure, GCP, AWS), including azure.json and various cloud-related artifacts;
  Quote: “The credentials collection logic in the new campaign’s samples targets the following services & technologies:”
• [T1057] Process Discovery – System profiling includes examining running processes;
  Quote: “ps aux Details about all running processes”
• [T1033] System Owner/User Discovery – Identity discovery via whoami and user listings;
  Quote: “Current user” and “List of users with active terminal sessions”