Hackers target Docker, Hadoop, Redis, Confluence with new Golang malware

Hackers are targeting misconfigured servers running Apache Hadoop YARN, Docker, Confluence, or Redis with new Golang-based malware that automates the discovery and compromise of the hosts. The malicious tools used in the campaign take advantage of the configuration weaknesses and exploit an old vulnerability in Atlassian Confluence to execute code on the machine. Researchers at cloud forensics and incident response company Cado Security discovered the campaign and analyzed the payloads used in attacks, bash scripts, and Golang ELF binaries. The researchers note that the intrusion set is similar to previously reported cloud attacks, some of them attributed to threat actors like TeamTNT, WatchDog, and Kiss-a-Dog. They started investigating the attack after getting an initial access alert on a Docker Engine API honeypot, with a new container based on Alpine Linux being spawned on the server. For the next steps, the threat actor relies on multiple shell scripts and common Linux attack techniques to install a cryptocurrency miner, establish persistence, and set up a reverse shell. According to the researchers, the hackers deploy a set of four novel Golang payloads that are responsible for identifying and exploiting hosts running services for Hadoop YARN (h.sh), Docker (d.sh), Confluence (w.sh), and Redis (c.sh). The names of the payloads are likely a poor attempt at disguising them as bash scripts. However, they are 64-bit Golang ELF binaries. “Interestingly, the malware develope...