EleKtra-Leak Cryptojacking Attacks Exploit AWS IAM Credentials Exposed on GitHub

November 6, 2023
|In Security
|By Security Team

In the dynamic landscape of cybersecurity, it’s imperative to stay informed about emerging threats. The EleKtra-Leak campaign is one such menace, targeting AWS IAM (Identity and Access Management) credentials that inadvertently find their way into public GitHub repositories. These credentials are exploited by cybercriminals to create EC2 instances for the illicit mining of Monero cryptocurrency. This campaign, active since December 2020, has created 474 EC2 instances between August 30 and October 6, 2023. In this blog, we’ll delve into the nuances of this threat and provide you with actionable remedies to fortify your AWS security.

Swift Attacks and Suspected Automation

One striking aspect of the EleKtra-Leak campaign is the speed at which attackers target newly exposed AWS IAM credentials on GitHub. Within just four minutes of their exposure, threat actors pounce on these credentials, implying the use of automated methods to seek and exploit these keys. Moreover, these attackers have been observed taking precautionary steps, such as blocking AWS accounts that publicly expose IAM credentials. This is likely an attempt to hinder further investigation. There’s also evidence suggesting that these same threat actors might have been involved in a previous cryptojacking campaign reported by Intezer in January 2021. That campaign targeted poorly secured Docker services and utilized the same custom mining software.

Weaknesses in GitHub and AWS

The success of EleKtra-Leak partly stems from vulnerabilities in GitHub’s secret scanning feature and AWS’ AWSCompromisedKeyQuarantine policy. These security measures are designed to detect and prevent the misuse of compromised or exposed IAM credentials for launching EC2 instances. Nevertheless, there is an underlying suspicion that the keys are being exposed through a method that has yet to be identified.

Remediation Steps

To shield your AWS assets from the EleKtra-Leak cryptojacking campaign and similar threats, consider implementing the following essential remedies:

  • Robust Passwords and MFA: Safeguard your AWS account by using a strong password and enable multi-factor authentication (MFA) for an added layer of security.
  • GitHub Secrecy: Never expose your AWS IAM credentials in public GitHub repositories. This is a common entry point for attackers, so exercise caution and maintain the confidentiality of your credentials.
  • Secrets Scanning: Employ a secrets scanner to promptly identify and remove any exposed AWS IAM credentials from your public GitHub repositories. Automated scans can help you detect leaks faster.
  • AWS Key Management Service (KMS): Implement AWS Key Management Service to enhance encryption and protection for your EC2 instances.
  • IAM Roles: Use AWS Identity and Access Management (IAM) roles to grant your EC2 instances only the necessary permissions. This limits potential damage in case credentials are compromised.
  • CloudTrail Monitoring: Regularly monitor your AWS CloudTrail logs for any signs of suspicious activity or unauthorized access. Swift detection can be crucial in mitigating threats.
  • Zero-Trust Security Model: Consider adopting a zero-trust security model. In this approach, trust is never assumed, and continuous verification is maintained. This can be highly effective against evolving threats.

Conclusion:

In a world where cyber threats are persistent and increasingly sophisticated, safeguarding your AWS assets is paramount. By following these remedies and adhering to best practices, you can significantly reduce your risk of falling victim to cryptojacking attacks like EleKtra-Leak. Stay vigilant and proactive in your cybersecurity efforts to ensure the safety of your digital infrastructure.