"Spinning YARN" cyberattackers wielding a Linux webshell are positioning for broader cloud compromise by exploiting common misconfigurations and a known Atlassian Confluence bug.

Dark Reading, Staff & Contributors

March 11, 2024

1 Min Read
hands holding a phone with docker logo
RAFAPRESS VIA SHUTTERSTOCK

Researchers have spotted a concerted cyber compromise campaign targeting cloud servers running vulnerable instances of Apache Hadoop, Atlassian Confluence, Docker, and Redis. The attackers are dropping a cryptomining tool, but also installing a Linux-based reverse shell that would allow potential future targeting and malware infestations.

According to an analysis from Cado Security, in most cases the adversary is hunting for common cloud misconfigurations to exploit. But, it has also been using an older remote code execution (RCE) vulnerability in Confluence server (CVE-2022-26134) in its ongoing campaign.

The researchers also said the attackers' tactics overlap with TeamTNT and WatchDog, two threat groups known for targeting cloud and container environments.

"The attacks are relatively hard-coded and automated, so they look for known vulnerabilities in Confluence and other platforms and well-known misconfigurations in platforms like Redis and Docker," says Chris Doman, co-founder and CTO at Cado Security.

Identifying these vulnerable instances is often simple, based on scanning as a first step and attacking identified vulnerable instances as a second step.

Read the Full Article on Dark Reading

About the Author(s)

Dark Reading

Staff & Contributors

Dark Reading: Connecting The Information Security Community

Long one of the most widely-read cybersecurity news sites on the Web, Dark Reading is also the most trusted online community for security professionals. Our community members include thought-leading security researchers, CISOs, and technology specialists, along with thousands of other security professionals.

Never Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.

You May Also Like


More Insights