“Efficient Cryptominer Deployment with gRPC and HTTP/2”

As shown in the attack chain (Figure 1), the attacker starts the discovery process by checking the Docker API’s availability and version (Figures 2 and 3). The attacker then sends a request for a gRPC/h2c upgrade (Figure 4).

Finally, the attacker checks for gRPC methods (Figure 5). These methods are designed to facilitate various operations within Docker, including health checks, file synchronization, authentication, secrets management, and SSH forwarding. They enable clients to perform tasks that are essential for managing and operating Docker environments. As shown in Table 1, each method serves a specific purpose, contributing to the overall functionality and security of Docker-based workflows. 

The attacker then sends a connection upgrade request to h2c protocol. Once the connection upgrade request has been processed by the server with all the required parameters using gRPC requests, the attacker sends the /moby.buildkit.v1.Control/Solve gRPC request to build the Docker image-based Dockerfile.srb (Figure 6), which contains Docker container building details based on the legitimate Docker image, debian:bookworm-slim (FIgure 7).

In the Dockerfile.srb details (Figure 8), we observed that the threat actor downloads and unzips the SRBMiner from GitHub into the /tmp/.1 directory, then deploys the cryptominer in the /usr/sbin directory. Afterwards, the threat actor starts the mining process; it provides their cryptocurrency wallet address, which starts with “r” (Ripple wallet IDs commonly start with this letter), and the cryptominer’s public IP address (with the periods replaced with underscores). 

Conclusion

Containerization platforms like Docker are instrumental in modern-day application development, but their features can become security liabilities if not meticulously protected. As demonstrated in this attack, cybercriminals can exploit features like remote management APIs to their advantage: The malicious actor in this case leveraged the gRPC protocol over H2C, effectively bypassing several security layers to deploy the SRBMiner cryptominer on the Docker host and mine XRP cryptocurrency illicitly.

To safeguard development environments from attacks targeting containers and hosts, we recommend that organizations relying on Docker adopt the following best practices:

• Containers and APIs should always be properly configured to minimize the chance of exploitative attacks. Docker provides guidelines on how their users can strengthen their security.
• Running containers should not be run with root privileges, but rather as application users instead.
• Containers should be configured so that access is granted only to trusted sources, such as the internal network.
• Organizations should adhere to recommended best practices. For example, Docker provides a comprehensive list of best practices and has built-in security features users can follow to improve the security of their cloud environments.
• Security audits should be performed at regular intervals to check for any suspicious containers and images.

Trend Micro also offers the following security solutions for safeguarding Docker servers:

• Trend Vision One™ – Container Security – for automated container image and registry scanning that helps detect threats early on
• Trend Cloud One™ – Workload Security – for protecting new and existing workloads against even unknown threats using techniques such as machine learning and virtual patching

Trend Micro Vision One Threat Intelligence 

To stay ahead of evolving threats, Trend Micro customers can access a range of Intelligence Reports and Threat Insights within Trend Micro Vision One. Threat Insights helps customers stay ahead of cyber threats before they happen and better prepared for emerging threats. It offers comprehensive information on threat actors, their malicious activities, and the techniques they use. By leveraging this intelligence, customers can take proactive steps to protect their environments, mitigate risks, and respond effectively to threats. 

 Trend Micro Vision One Intelligence Reports App [IOC Sweeping]

Using gRPC and HTTP/2 for Crypto Miner Deployment

Trend Micro Vision One Threat Insights App

Emerging Threats: Using gRPC and HTTP/2 for Cryptominer Deployment: An Unconventional Approach

Hunting Queries 

Trend Micro Vision One Search App

Trend Micro Vision One Customers can use the Search App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.   

SBRMiner C&C Connections: 

eventId:3 AND (“src:59.93.45.16*” OR “dst:59.93.45.16*” OR “src:167.71.194.227:3333” OR “dst:167.71.194.227:3333”)

More hunting queries are available for Vision One customers with Threat Insights Entitlement enabled.