0 Persons are tagged with #serverless

#serverless

waynerad@diasp.org
Wayne Radinsky

Malware specifically designed to execute in an Amazon Web Services (AWS) Lambda environment. "We named this malware Denonia, after the name the attackers gave the domain it communicates with. The malware uses newer address resolution techniques for command and control traffic to evade typical detection measures and virtual network access controls. Although this first sample is fairly innocuous in that it only runs crypto-mining software, it demonstrates how attackers are using advanced cloud-specific knowledge to exploit complex cloud infrastructure, and is indicative of potential future, more nefarious attacks."

"Whilst it has the filename 'python' -- the malware is actually written in Go and seems to contain a customised variant of the XMRig mining software, along with other unknown functions."

When tested by the researchers, it emitted error messages with environment variables are specific to Lambda. It is also compiled with libraries specific to lambda such as github.com/aws/aws-lambda-go/lambda.

Cado Discovers Denonia: The First Malware Specifically Targeting Lambda

#solidstatelife #cybersecurity #malware #serverless

4 Likes
1 Shares