Rewterz Threat Alert – CoinMiner Exploits SaltStack Vulnerability

Severity

High

Analysis Summary

Coinminer Kinsing botnet is found using the recently discovered Salt Stack vulnerability CVE-2020-11651. It’s an authentication bypass vulnerability reported earlier today. This malware operation has been scanning the internet for Docker servers running API ports exposed on the internet without a password. Hackers are then breaking into unprotected hosts and installing a new crypto-mining malware strain named Kinsing. These attacks are just the last in a long list of malware campaigns that have targeted Docker instances. In this campaign, attackers are targeting the SaltStack authentication bypass vulnerability to deploy Kinsing malware.

The target is, systems that, when compromised, provide hacker groups with unfettered access to vast computational resources. It may also gather local SSH credentials in an attempt to spread to a company’s container network, to infect other cloud systems with the same malware.

Impact

• Authentication Bypass
• Resource Consumption

Indicators of Compromise

MD5

• a28ded80d7ab5c69d6ccde4602eef861
• 8ec3385e20d6d9a88bc95831783beaeb

SHA-256

• b618781f971528796dc5aa1030987b9112a544b7dc5b3bd0f818cc105142d717
• 9fbb49edad10ad9d096b548e801c39c47b74190e8745f680d3e3bcd9b456aafc

SHA1

• 24962f4718d8884ddfd843100c8ff2648def1f38
• 968913a21097aa2d835efb96782b3be82dbcac45

Source IP

• 217[.]12[.]210[.]192
• 206[.]189[.]92[.]32

Remediation

• Block the threat indicators at their respective controls.
• SaltStack engineers patched these vulnerabilities in release 3000.2. Immediately apply update.
• A patch release for the previous major release version is also available, with version number 2019.2.4.