Real-World Detection Evasion Techniques in the Cloud
summary
Three cloud campaigns reveal concrete evasion: CoinStomp time-stomps binaries with touch -t and obfuscates chmod/chattr usage, opens a /dev/tcp reverse shell to 106.53.115.0:114 over port 443 and schedules cron jobs that kill scanners; Watchdog renames ps to pslanigiro and supplies a wrapper that filters out processes containing ddns/scan, hides payloads in “…” directories and appends shell scripts to PNGs; Denonia targets AWS Lambda, runs an embedded xmrig miner from /tmp, resolves C2 via DNS-over-HTTPS to dns.google.com and talks to 116.203.0.4:3333; a honeypot is compromised in 12 minutes and ~50,000 Redis nodes expose port 6379.
AI-written summary · about
chapters (10)
- 0:00Cloud malware evasion intro
- 1:47Cloud security threats today
- 7:43Cloud infection vectors
- 9:54Malware impact and goals
- 10:15CoinStomp malware overview
- 14:12CoinStomp evasion techniques
- 18:35Watchdog campaign analysis
- 25:02Denonia serverless malware
- 33:54Cloud malware campaigns summary
- 36:23Key takeaways
related talks
50mThe Anatomy of Cloud Attacks
52mFlying Under the Radar - New Security Evasion Techniques
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
41mIdentifying and Mitigating Cloud and Container Threats
18mSecuring cloud innovation: Lessons learned
30mTales of Red Teaming
44mLive Hacking Cloud Architectures
50mInsights into New Supply Chain and Cloud-Identity Attacks