A Tale of Two Malware Families - Overcoming Anti-Forensics and Foiling Botnets in the Cloud

The talk opens with what the speaker calls the cloud challenge: attackers keep moving toward cloud compute, containers and serverless services, while defenders often lack visibility into their environments. Although most cloud intruders rely on simple shell scripts rather than advanced exploits, they use Linux-specific tricks to slow down investigators.

The first family, CoinStomp, is a cryptojacking campaign aimed mainly at Asian cloud providers. The researchers described how it copies chmod and chattr to new names and uses touch with hard-coded dates to rewrite timestamps, and how it attempts to remove system cryptographic policies. It also opens a plain-text reverse shell over port 443, uses a cron job to kill tail and mask, and references an older campaign to muddy attribution. Their test showed that file creation times still exposed the tampering. The second family, ABC Bot, spreads through initialization scripts, removes rival miners, disables cloud security agents, plants SSH keys and propagates via known hosts. Comparing it with the Xanthi campaign revealed shared function layout, identical usernames and a common command-and-control address in iptables rules, suggesting one actor behind both.

The talk closes with a recent Watchdog example that hid processes by filtering renamed ps output through grep and used a directory named with an ellipsis to mimic the parent directory. Practical advice includes auditing hosts, avoiding exposed Docker and Redis services, watching /usr/bin and /bin for renamed binaries, keeping a vaccine host with known hosts entries, enabling cloud logging, and alerting on touch with time-setting flags.