• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – Cerberus Variant Using MDM As Infection Vector
May 4, 2020
Rewterz Threat Alert – WebMonitor RAT Bundled with Zoom Installer
May 4, 2020

Rewterz Threat Alert – CoinMiner Exploits SaltStack Vulnerability

May 4, 2020

Severity

High

Analysis Summary

Coinminer Kinsing botnet is found using the recently discovered Salt Stack vulnerability CVE-2020-11651. It’s an authentication bypass vulnerability reported earlier today. This malware operation has been scanning the internet for Docker servers running API ports exposed on the internet without a password. Hackers are then breaking into unprotected hosts and installing a new crypto-mining malware strain named Kinsing. These attacks are just the last in a long list of malware campaigns that have targeted Docker instances. In this campaign, attackers are targeting the SaltStack authentication bypass vulnerability to deploy Kinsing malware. 

The target is, systems that, when compromised, provide hacker groups with unfettered access to vast computational resources. It may also gather local SSH credentials in an attempt to spread to a company’s container network, to infect other cloud systems with the same malware.

Impact

  • Authentication Bypass
  • Resource Consumption

Indicators of Compromise

MD5

  • a28ded80d7ab5c69d6ccde4602eef861
  • 8ec3385e20d6d9a88bc95831783beaeb

SHA-256

  • b618781f971528796dc5aa1030987b9112a544b7dc5b3bd0f818cc105142d717
  • 9fbb49edad10ad9d096b548e801c39c47b74190e8745f680d3e3bcd9b456aafc

SHA1

  • 24962f4718d8884ddfd843100c8ff2648def1f38
  • 968913a21097aa2d835efb96782b3be82dbcac45

Source IP

  • 217[.]12[.]210[.]192
  • 206[.]189[.]92[.]32

Remediation

  • Block the threat indicators at their respective controls.
  • SaltStack engineers patched these vulnerabilities in release 3000.2. Immediately apply update.
  • A patch release for the previous major release version is also available, with version number 2019.2.4.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.