🎯Basically, hackers are using a sneaky method to steal passwords from cloud services.
What Happened
China-aligned hackers are executing a cloud credential heist using a sophisticated Linux-based ELF backdoor. This malware targets workloads across major cloud providers including AWS, GCP, Azure, and Alibaba Cloud. According to findings from Breakglass Intelligence, the backdoor operates using a unique zero-detection technique, employing SMTP port 25 for covert command-and-control (C2) communications.
Who's Behind It
This campaign is attributed to the APT41 (Winnti) group, known for its long-standing cyber espionage activities. The group has been active since at least 2020, with tactics evolving significantly over the years. Their latest campaign leverages deception, using typosquatted domains that closely resemble legitimate Alibaba Cloud services to blend malicious traffic into regular operations.
How It Works
Once the backdoor is executed, it queries the instance metadata service, commonly accessed at 169.254.169.254. This allows the malware to retrieve sensitive access tokens and configuration data specific to the cloud environment. For instance:
- AWS: IAM role credentials
- GCP: Service account tokens
- Azure: Managed identity tokens
- Alibaba Cloud: RAM role credentials
The malware also utilizes a UDP broadcast to communicate with other compromised hosts, enabling lateral movement without additional C2 traffic. This method allows for peer-to-peer coordination, enhancing the stealth of the operation.
Indicators and Detection
Despite its stealthy nature, researchers have identified key indicators of compromise (IoCs). These include:
- Unusual outbound SMTP traffic
- Connections to typosquatted domains resembling Alibaba Cloud
- Periodic UDP broadcasts to 255.255.255.255:6006
Defenders are advised to monitor for obfuscated ELF binaries and unexpected access to instance metadata endpoints. Additionally, tracking anomalous use of role-based credentials can help detect this ongoing threat.
What You Should Do
Organizations should enhance their cloud security posture by implementing strict egress filtering on port 25 and monitoring for any unusual activity. Regular audits of cloud configurations and credential usage can also mitigate risks associated with this type of attack. Awareness and training for staff about the risks of typosquatting and phishing can further strengthen defenses against such sophisticated threats.
🔒 Pro insight: The use of typosquatting and SMTP for C2 highlights the need for advanced detection mechanisms in cloud environments.
