Rewterz Threat Alert – Cerberus Variant Using MDM As Infection Vector
May 4, 2020Rewterz Threat Alert – WebMonitor RAT Bundled with Zoom Installer
May 4, 2020Severity
High
Analysis Summary
Coinminer Kinsing botnet is found using the recently discovered Salt Stack vulnerability CVE-2020-11651. It’s an authentication bypass vulnerability reported earlier today. This malware operation has been scanning the internet for Docker servers running API ports exposed on the internet without a password. Hackers are then breaking into unprotected hosts and installing a new crypto-mining malware strain named Kinsing. These attacks are just the last in a long list of malware campaigns that have targeted Docker instances. In this campaign, attackers are targeting the SaltStack authentication bypass vulnerability to deploy Kinsing malware.
The target is, systems that, when compromised, provide hacker groups with unfettered access to vast computational resources. It may also gather local SSH credentials in an attempt to spread to a company’s container network, to infect other cloud systems with the same malware.
Impact
- Authentication Bypass
- Resource Consumption
Indicators of Compromise
MD5
- a28ded80d7ab5c69d6ccde4602eef861
- 8ec3385e20d6d9a88bc95831783beaeb
SHA-256
- b618781f971528796dc5aa1030987b9112a544b7dc5b3bd0f818cc105142d717
- 9fbb49edad10ad9d096b548e801c39c47b74190e8745f680d3e3bcd9b456aafc
SHA1
- 24962f4718d8884ddfd843100c8ff2648def1f38
- 968913a21097aa2d835efb96782b3be82dbcac45
Source IP
- 217[.]12[.]210[.]192
- 206[.]189[.]92[.]32
Remediation
- Block the threat indicators at their respective controls.
- SaltStack engineers patched these vulnerabilities in release 3000.2. Immediately apply update.
- A patch release for the previous major release version is also available, with version number 2019.2.4.