How Cybercriminals Use Malware to Target Linux-Based Operating Systems
As the most common cloud operating system, Linux is a central part of digital infrastructure and is quickly becoming an attack ticket for a multi-cloud environment. Current anti-malware countermeasures are primarily focused on countering Windows-based threats, leaving many public and private cloud deployments vulnerable to attacks targeting Linux-based workloads, VMware reveals.
Key findings that detail how cybercriminals use malware to target Linux-based operating systems include:
- Ransomware is evolving to target host images used to spin up workloads in virtualized environments
- 89% of cryptojacking attacks use XMRig-related libraries, and
- More than half of Cobalt Strike users may be cybercriminals, or at least using Cobalt Strike illicitly.
“Cybercriminals are dramatically expanding their reach and adding malware that targets Linux-based operating systems to their attack toolkit to maximize their impact with the least amount of effort,” said Giovanni Vigna, Director principal of threat intelligence at VMware.
“Rather than infecting an endpoint and then navigating to a higher value target, cybercriminals have discovered that by compromising a single server, they can gain the massive gains and access they seek. Attackers view public and private clouds as high-value targets because of the access they provide to critical infrastructure services and confidential data. Unfortunately, current malware countermeasures focus primarily on combating Windows-based threats, leaving many public and private cloud deployments vulnerable to attacks on Linux-based operating systems.
As malware targeting Linux-based operating systems increases in volume and complexity in a rapidly changing threat landscape, organizations must place a higher priority on threat detection.
Ransomware targets the cloud to inflict maximum damage
As one of the leading causes of breaches for organizations, a successful ransomware attack on a cloud environment can have devastating consequences. Ransomware attacks against cloud deployments are targeted and are often combined with data exfiltration, implementing a double extortion scheme that improves the chances of success. A new development shows that Linux-based ransomware is evolving to target host images used to spin up workloads in virtualized environments.
Attackers now seek out the most valuable assets in cloud environments to inflict maximum damage on the target. Examples include the Defray777 ransomware family, which encrypts host images on ESXi servers, and the DarkSide ransomware family, which crippled Colonial Pipeline networks and caused a national gasoline shortage in the United States.
Cryptojacking attacks use XMRig to mine Monero
Cybercriminals looking for instant monetary reward often target cryptocurrencies using one of two approaches. Cybercriminals either include wallet-stealing functionality in malware or they monetize stolen CPU cycles to successfully mine cryptocurrencies in an attack called cryptojacking. Most cryptojacking attacks focus on mining Monero (or XMR) currency, and VMware TAU found that 89% of cryptominers used XMRig-related libraries. For this reason, when XMRig-specific libraries and modules in Linux binaries are identified, it is likely evidence of malicious cryptomining behavior.
Defense evasion is the most common technique used by Linux-based cryptominers. Unfortunately, since cryptojacking attacks do not completely disrupt the operations of cloud environments like ransomware, they are much harder to detect.
Cobalt Strike is the remote access tool of choice for attackers
In order to gain control and persist in an environment, attackers seek to install an implant on a compromised system that gives them partial control of the machine. Malware, webshells, and Remote Access Tools (RATs) can all be implants attackers use in a compromised system to allow remote access. One of the main implants used by attackers is Cobalt Strike, a commercial penetration test and red team tool, and its recent Linux-based Vermilion Strike variant.
Since Cobalt Strike is such a ubiquitous threat on Windows, the expansion to the Linux operating system demonstrates threat actors’ desire to use readily available tools that target as many platforms as possible.
More than 14,000 active Cobalt Strike Team servers were discovered on the Internet between February 2020 and November 2021. The total percentage of cracked and leaked Cobalt Strike client credentials is 56%, which means that more than half of Cobalt Strike users Strike may be cybercriminals, or at least using Cobalt Strike illicitly. The fact that RATs like Cobalt Strike and Vermilion Strike have become a staple tool for cybercriminals poses a significant threat to businesses.
“Since we performed our analysis, even more ransomware families have been observed revolving around Linux-based malware, with the potential for additional attacks that could exploit Log4j vulnerabilities,” said Brian Baskin, research lead. on threats at VMware.
“The findings of this report can be used to better understand the nature of Linux-based malware and mitigate the growing threat of ransomware, cryptomining, and RATs to multi-cloud environments. As attacks targeting the cloud continue to evolve, organizations must adopt a zero-trust approach to embedding security throughout their infrastructure and systematically addressing the threat vectors that make up their attack surface.