A recently observed form of malware uses a concerning new trick to avoid detection and mine cryptocurrency on cloud servers.
Two researchers, Xingyu Jin and Claud Xiao, from cybersecurity firm Palo Alto Networks, published a report on Thursday, saying that a nasty bit of software from bad actors dubbed the Rocke group is targeting public cloud infrastructure. Once downloaded, it takes administrative control to first uninstall cloud security products and then inject code that mines the monero cryptocurrency.
The researchers found that the Rocke malware injected code to uninstall five different cloud security products from infected Linux servers – including offerings from top Chinese cloud providers, Alibaba (NYSE:BABA) and Tencent. Adding insult to injury, the malware follows the uninstall steps set out in the products’ user manuals.