Cyber Risks · Unit 42 Palo Alto Networks

Pro-Ocean: Rocke Group’s New Cryptojacking Malware

Summary: Unit 42 documented a revised Rocke Group cloud cryptojacking malware, named Pro-Ocean after the attacker's installation script, that adds rootkit and worm capabilities to the earlier Monero-mining code. Pro-Ocean exploits Apache ActiveMQ (CVE-2016-3088), Oracle WebLogic (CVE-2017-10271) and unsecured Redis instances, deploys an XMRig 5.11.1 miner, and uses a Python script to scan and infect machines across the same 16-bit subnet.
Bottom line: The malware uninstalls monitoring agents on Alibaba Cloud and Tencent Cloud and kills any process using heavy CPU so it can take 100% of the CPU to mine Monero, which means agent-based cloud security may not detect it at all.

Read the original at Unit 42 Palo Alto Networks ↗

Topics: Threat Actors & Nation-State
Mentions: CVE-2016-3088 CVE-2017-10271
Related: Rocke: The Champion of Monero Miners Cyber Risks ·
Cisco Talos Honeypot Analysis Reveals Rise in Attacks on Elasticsearch Clusters Cyber Risks ·
Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products Cyber Risks ·