Malware Used by Rocke Group Evolves to Evade Detection by Cloud Security Products
Summary: Palo Alto Networks Unit 42 analyzed Linux coin-mining malware samples used by the Rocke group, collected in October 2018, that uninstall five cloud security and monitoring products from compromised servers after first gaining full administrative control of the hosts. The malware follows the official uninstall procedures published by Alibaba Cloud and Tencent Cloud for their Threat Detection Service and Host Security products, and Unit 42 calls it the first malware family known to target and remove cloud security products.
What you should know: The malware does not defeat these agent-based cloud workload protection products; it removes them with legitimate administrator rights, so detection depends on noticing the uninstall before the Monero mining begins. Unit 42 states plainly that agent-based cloud security may not be enough against evasive malware aimed at public cloud infrastructure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2017-10271
- Related
- Rocke: The Champion of Monero Miners Cyber Risks ·Pro-Ocean: Rocke Group’s New Cryptojacking Malware Cyber Risks ·