Select Page

Cybersecurity researchers have unearthed an attack infrastructure that’s being used as part of a “potentially massive campaign” against cloud-native environments.

“This infrastructure is in early stages of testing and deployment, and is mainly consistent of an aggressive cloud worm, designed to deploy on exposed JupyterLab and Docker APIs in order to deploy Tsunami malware, cloud credentials hijack, resource hijack, and further infestation of the worm,” cloud security firm Aqua said.

The activity, dubbed Silentbob in reference to an AnonDNS domain set up by the attacker, is said to be linked to the infamous cryptojacking group tracked as TeamTNT, citing overlaps in tactics, techniques, and procedures (TTPs). However, the involvement of an “advanced copycat” hasn’t been ruled out.

images from Hacker News