'Cloud Snooper' Attack Circumvents AWS Firewall Controls

[UPDATED 2/27 with new information from Sophos that the attack actually hit on-premise firewalls and servers in the victim organization. This article originally reported on the initial research by Sophos, which had concluded that the malware had the ability to breach on-site firewalls.]

RSA CONFERENCE 2020 - San Francisco - A recently spotted targeted attack employed a rootkit to sneak malicious traffic through the victim organization's AWS and on-premise firewalls and drop a remote access Trojan (RAT) onto its cloud-based servers.

Researchers at Sophos discovered the attack while inspecting infected Linux and Windows EC2-based cloud infrastructure servers running in Amazon Web Services (AWS). The attack, which Sophos says is likely the handiwork of a nation-state, uses a rootkit that not only gave the attackers remote control of the servers but also provided a conduit for the malware to communicate with their command-and-control servers. According to Sophos, the rootkit also allowed the C2 servers to remotely control servers physically located in the organization as well.

"The firewall policy was not negligent, but it could have been better," said Chet Wisniewski, principal research scientist at Sophos. The attackers masked their activity by hiding it in HTTP and HTTPS traffic. "The malware was sophisticated enough that it would be hard to detect even with a tight security policy" in the AWS firewall, he said. "It was a wolf in sheep's clothing ... blending in with existing traffic."

Sophos declined to reveal the victim organization, but said the attack appears to be a campaign to reach ultimate targets via the supply chain - with this as just one of the victims. Just who is behind the attack is unclear, but the RAT is based on source code of the Gh0st RAT, a tool associated with Chinese nation-state attackers. Sophos also found some debug messages in Chinese.

The attackers appear to reuse the same RAT for both the Linux and Windows servers. "We only observed the Linux RAT talking to one server and the Windows talking to a different control server, so we're not sure if it's even the same infrastructure," Wisniewski said. The C2 has been taken down, he noted.

Just how the attackers initially hacked into the victim's network is unclear, but Sophos suggests one possibility is the attackers infiltrated a server via SSH. They also don't have a lot of intel on the rootkit, such as which port it abused, nor do they know for sure what they were after. "It's likely a supply chain attack, targeting this organization to get all of their downstream" clients or customers, Wisniewski said. 

One of the rare aspects of the attack: It targeted Linux with a rootkit, which was called Snoopy. "They dropped the driver part of the rootkit, and called it Snoopy. Had it been called a legitimate file name on the Linux box, we probably wouldn't have noticed it," Wisniewski said. And malware for Linux to date has been relatively rare, too, with mainly cryptojackers, he added.

Cloud Snooper's techniques for now appear to be rare, but like many unique attacks like this, it's only a matter of time before they are imitated. "Every time we see something done in a targeted attack usually by a nation-state, a couple of years later cybercriminals [adopt similar tactics]," Wisniewski said.

"This case is extremely interesting as it demonstrates the true multi-platform nature of a modern attack," wrote Sophos researcher Sergei Shevchenko in the company's technical report on Cloud Snooper.

Sophos recommends deploying AWS's boundary firewall function, keeping Internet-facing servers fully patched, and hardening SSH servers to protect against Cloud Snooper.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "How to Prevent an AWS Cloud Bucket Data Leak."