New Cryptojacking Operation Targeting Kubernetes Clusters for Dero Mining

Mar 15, 2023Ravie LakshmananServer Security / Cryptocurrency

Cybersecurity researchers have discovered the first-ever illicit
cryptocurrency mining campaign used to mint Dero since the start of
February 2023.

“The novel Dero cryptojacking operation concentrates on locating
Kubernetes clusters with anonymous access enabled on a Kubernetes
API and listening on non-standard ports accessible from the
internet,” CrowdStrike said^[1]
in a new report shared with The Hacker News.

The development marks a notable shift from Monero, which is a
prevalent cryptocurrency used in such campaigns. It’s suspected it
may have to do with the fact that Dero^[2] “offers larger rewards
and provides the same or better anonymizing features.”

The attacks, attributed to an unknown financially motivated
actor, commence with scanning for Kubernetes clusters with
authentication set as –anonymous-auth=true^[3], which allows anonymous
requests to the server, to drop initial payloads from three
different U.S.-based IP addresses.

This includes deploying a Kubernetes DaemonSet^[4]
named “proxy-api,” which, in turn, is used to drop a malicious pod
on each node of the Kubernetes cluster to kick-start the mining
activity.

To that end, the DaemonSet’s YAML file is orchestrated to run a
Docker image that contains a “pause” binary, which is actually the
Dero coin miner^[5].

“In a legitimate Kubernetes deployment, ‘pause’ containers are
used by Kubernetes to bootstrap a pod,” the company noted.
“Attackers may have used this name to blend in to avoid obvious
detection.”

The cybersecurity company said it identified a parallel
Monero-mining campaign also targeting exposed Kubernetes clusters
by attempting to delete the existing “proxy-api” DaemonSet
associated with the Dero campaign.

This is an indication of the ongoing tussle^[7]
between cryptojacking groups that are vying for cloud resources to
take and retain control of the machines and consume all of its
resources.

“Both campaigns are trying to find undiscovered Kubernetes
attack surfaces and are battling it out,” CrowdStrike threat
researchers Benjamin Grap and Manoj Ahuje said.