Proxyjacking and Cryptomining Campaign Targets GitLab
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-22205 | Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205) GitLab CE/EE versions from 11.9 onward fail to properly validate image files before passing them to the bundled ExifTool file parser, enabling command/code injection (CWE-94). A remote, unauthenticated attacker triggers it by getting the server to parse a specially crafted image (e.g., through file-upload features), with no credentials or user interaction required. Successful exploitation yields arbitrary command execution on the GitLab server, exposing source code, credentials, CI/CD data, and the wider network (CVSS 10.0, scope-changed). All self-managed GitLab Community and Enterprise Edition deployments on affected versions are exposed. The flaw is actively exploited in the wild: it is on CISA's KEV with known ransomware use, public PoCs exist, and 2021 campaigns used it for ransomware, cryptojacking, and access brokering against GitLab servers. Do: Upgrade immediately to the patched releases - 13.10.3 or later, or the corresponding 13.9.6/13.8.6/13.7.9 backports - per vendor instructions, as required for KEV entries. Until patched, restrict network access to internet-facing GitLab instances and verify the bundled ExifTool is current. Hunt for signs of compromise (suspicious processes or cron jobs, cryptominers, webshells, new SSH keys, unexpected outbound connections), given documented ransomware and cryptojacking abuse. | 10.0 | 100% | KEV ransomware PoC ×2 |
| largetens of thousands of internet-exposed self-managed GitLab instances (order of ~50,000+ servers in public scans) |
Full article384 words · extracted from infosecurity-magazine.com · click to collapse
Security researchers have discovered a new financially motivated cyber-threat campaign designed to make money from cryptomining and proxyjacking while staying hidden using a variety of techniques.
The Labrat campaign was discovered by a team at Sysdig, who observed the threat actors compromise a targeted container via legacy GitLab remote code execution vulnerability CVE-2021-22205.
The end goal is to make money by cryptomining and proxyjacking; the latter being attacks where threat actors rent out a compromised system to a proxy network.
To maintain this revenue stream, the threat group are going to extreme lengths to stay hidden from researchers and network defenders, Sysdig claimed.
“It is common to see attackers utilize scripts as their malware because they are simpler to create. However, this attacker chose to use undetected compiled binaries, written in Go and .NET, which allowed the attacker to hide more effectively,” the security vendor explained.
“Furthermore, the attacker abused a legitimate service, TryCloudFlare, to obfuscate their C2 network.”
Moreover, the attackers are constantly updating their binaries in order to avoid detection, Sysdig claimed.
To maintain persistence, the Labrat attackers use a legitimate open-source tool known as Global Socket (GSocket).
“Much like Netcat, GSocket has legitimate uses, but of course it can also be used by attackers,” Sysdig wrote.
“Unlike Netcat, GSocket provides features such as a custom relay or proxy network, encryption, and the ability to use TOR, making it a very capable tool for stealthy C2 communications. To remove evidence of its installation, the LABRAT attacker tried to hide the process.”
The campaign is ongoing and may even be designed to go beyond proxyjacking and cryptomining, given that the backdoor used provides access to compromised systems, the research team concluded.
“Users impacted by CVE-2021-22205 should follow their organization's security incident and disaster recovery processes to deprovision the compromised instance and restore the latest good working backup to a new GitLab instance,” noted a GitLab statement sent to Infosecurity.
“The vulnerability has been patched since 2021 and the impact is on customers who remain on vulnerable versions. We issued a blog post regarding the vulnerability and a forum post about how users can determine if they have been impacted.”
Editorial image credit: T. Schneider / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/proxyjacking-cryptomining-campaign/