There’s no honor among thieves as a new worm steals from other infectious software. It pilfers “multiple” victims’ credentials and mines for cryptocurrency while killing competitors’ processes, including similar secret-harvesting malware.
It’s called Cloud AI Infrastructure Attack Framework (CAI), and it’s a centralized botnet that targets cloud-native developer tools like Docker, Kubernetes, Redis, etcd, Kubelet, and Ray for credential theft and cryptomining.
The scripts “are heavily inspired” by the likes of other similar credential-stealing worms that have wreaked havoc across cloud environments and supply chains this year, “using code comments like ‘PCPJack-aligned,’” according to security researcher Michael R.
Read more…
Source: The Register
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- London issues call to arms to cyber security community
October 13, 2017
Cyber security community called on to help educate capital’s small businesses about cyber crime and give them practical advice London is calling on the cyber security community to help keep the city’s more than one million small businesses safe from cyber crime. “Cyber crime is a growing problem for everyone, but while individuals are protected by their ...
- Swedish transport agencies targeted in cyber attack
October 12, 2017
Swedish transport authorities were hit by a cyber attack on Thursday morning, a day after trains were delayed as a result of another attack on IT systems monitoring railway traffic. The website of Sweden’s Transport Agency (Transportstyrelsen) was partially down on Thursday morning, according to the agency most likely as a result of a DDoS attack. During ...
- Cyber-security threat to UK ‘as serious as terrorism’ – GCHQ
October 9, 2017
Keeping the UK safe from cyber-attacks is now as important as fighting terrorism, the head of the intelligence monitoring service GCHQ has said. Jeremy Fleming said increased funding for GCHQ was being spent on making it a “cyber-organisation” as much as an intelligence and counter-terrorism one. It comes after the NHS and parliament suffered cyber-attacks this year. Mr ...
- Disqus Hacked: More than 17.5 Million Users’ Details Stolen in 2012 Breach
October 6, 2017
Another day, Another data breach disclosure. This time the popular commenting system has fallen victim to a massive security breach. Disqus, the company which provides a web-based comment plugin for websites and blogs, has admitted that it was breached 5 years ago in July 2012 and hackers stole details of more than 17.5 million users. The stolen data ...
- Spy vs spy vs hacker vs… who is THAT? Everyone’s hacking each other
October 5, 2017
VB2017 Intel agencies and top-tier hackers are actively hacking other hackers in order to steal victim data, borrow tools and techniques, and reuse each other’s infrastructure, attendees at Virus Bulletin Con, Madrid, were told yesterday. The increasing amount of spy-vs-spy type activity is making accurate threat intel increasingly difficult for security researchers, according to Kaspersky Lab. Threat intelligence ...
- FormBook—Cheap Password Stealing Malware Used In Targeted Attacks
October 5, 2017
It seems sophisticated hackers have changed the way they conduct targeted cyber operations—instead of investing in zero-days and developing their malware; some hacking groups have now started using ready-made malware just like script kiddies. Possibly, this could be a smart move for state-sponsored hackers to avoid being attributed easily. Security researchers from multiple security firms, including Arbor Networks and FireEye, ...