It's no secret that cryptocurrency mining can be a lucrative endeavor. So it's no surprise that bad actors are constantly looking for new ways to get their hands on some digital coins. The latest development in this space is the discovery of the first-ever illicit cryptocurrency mining campaign used to mint Dero. According to a new report from CrowdStrike, the development marks a notable shift from Monero, which is a prevalent cryptocurrency used in such campaigns. It's suspected it may have to do with the fact that Dero "offers larger rewards and provides the same or better anonymizing features."
The attacks, attributed to an unknown financially motivated actor, commence with scanning for Kubernetes clusters with authentication set as --anonymous-auth=true, which allows anonymous requests to the server, to drop initial payloads from three different U.S.-based IP addresses. This includes deploying a Kubernetes DaemonSet named "proxy-api," which, in turn, is used to drop a malicious pod on each node of the Kubernetes cluster to kick-start the mining activity.
To that end, the DaemonSet's YAML file is orchestrated to run a Docker image that contains a "pause" binary, which is actually the Dero coin miner. "In a legitimate Kubernetes deployment, 'pause' containers are used by Kubernetes to bootstrap a pod," the company noted. "Attackers may have used this name to blend in to avoid obvious detection."
If you're running a Kubernetes cluster, it's important to make sure that authentication is properly configured to prevent this type of attack. But even if you're not, it's still interesting to see how bad actors are adapting their methods to stay one step ahead of the game.