Aqua detected a multistage fileless XMRig cryptojacking campaign targeting containerized Node.js applications built with Next.js, exposing malicious activity across in-memory execution, container drift, persistence, and outbound mining communication. The campaign used tactics like memfd-based loading, cron and rc.d persistence, SSH key backdoors, and anti-removal defenses, while Aqua runtime enforcement could block the attack before unauthorized code ran or mining traffic left the workload. #XMRig #Nextjs #Aqua #memfd #Nodejs
Keypoints
- Aqua identified a multistage fileless cryptojacking campaign in a customer environment.
- The affected workloads were containerized Node.js applications built with Next.js (React).
- The attack began in memory using a Next.js exploit and a wget | sh style downloader to run a first-stage script without writing files to disk.
- The campaign included hidden execution, newly introduced binaries, guard and watchdog processes, and process masquerading to maintain the miner.
- Persistence was established through cron jobs, init scripts in rc.d, shell profile changes, and an SSH authorized_keys backdoor.
- The attacker used chattr +i to make files immutable and harder to remove after discovery.
- The XMRig miner communicated with a Monero mining pool over standard ports, and Aqua linked that traffic to the exact process generating it.
MITRE Techniques
- [T1059.004 ] Command and Scripting Interpreter: Unix Shell – The attacker executed a remote shell pipeline to run a first-stage script directly in memory (‘wget -O- | sh’).
- [T1105 ] Ingress Tool Transfer – A remote script and packed loader were fetched from attacker infrastructure (‘pull and run a first stage script directly from a remote location’).
- [T1027 ] Obfuscated Files or Information – The loader was described as packed and unpacked into memory, reducing visibility to file-based scanners (‘fetched a packed loader, which unpacked directly into memory’).
- [T1055 ] Process Injection – The campaign used memory-resident execution through Node.js and in-memory loading behavior (‘Execution began in memory’).
- [T1087 ] Account Discovery – The attacker modified SSH authorized keys for backdoor access on compromised hosts (‘installed an SSH key as a backdoor’).
- [T1053.003 ] Scheduled Task/Job: Cron – Persistence was created with cron jobs (‘The attacker established persistence through cron jobs’).
- [T1543.002 ] Create or Modify System Process: Systemd Service – Persistence was also established through init scripts in rc.d (‘init scripts in rc.d’).
- [T1546.001 ] Event Triggered Execution: Unix Shell Configuration Modification – Shell profile modifications were used for persistence (‘shell profile modifications’).
- [T1222.002 ] File and Directory Permissions Modification: Linux and Mac File and Directory Permissions – The attacker set immutable flags to prevent deletion (‘used chattr +i to set immutable flags on key files’).
- [T1070.004 ] File Deletion: File Deletion – Anti-removal behavior aimed to prevent cleanup of malicious files (‘preventing deletion even by processes running as root’).
- [T1496 ] Resource Hijacking – The XMRig miner performed cryptomining against the victim workload (‘active mining’).
- [T1071.004 ] Application Layer Protocol: DNS – Not mentioned.
- [T1041 ] Exfiltration Over C2 Channel – Not mentioned.
Indicators of Compromise
- [SHA-256 hashes] Malware components and payloads – b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49, 82258b64b331d1f0d345292b69da6e6f4381e8c7249654140b2c1167353b534b, and 4 more hashes
- [URLs] Stage-1 payload hosting and staging – hxxp://221.156.167[.]200:9090/js/, hxxp://77.90.13[.]20/dashboard, and other 1 item
- [IP addresses] Payload and staging infrastructure – 221.156.167[.]200, 185.216.75[.]152, and 77.90.13[.]20
- [Domains] Re-infection and stager hosting – pastebin[.]com/raw/7nCDtDwS, pastebin[.]com/raw/Z7HfUZPJ, and cts-assets[.]s3[.]us-west-1[.]amazonaws[.]com
- [File names] Staged payloads and downloaded artifacts – grepb32.txt, grep.json, grep.rar, grep00.sh, grep2.jpg
- [Cloud storage buckets] S3-hosted stagers – cts-assets[.]s3[.]us-west-1[.]amazonaws[.]com, redclub-websites-offer-images[.]s3[.]amazonaws[.]com
Read more: https://www.aquasec.com/blog/how-did-aqua-catch-a-cryptomining-attack-hiding-in-memory/