The Ever-shifting Habits of Cloud-focused Malware Campaigns

The talk traces how malware aimed at cloud environments has changed, moving beyond cryptojacking toward serverless functions and containers as cloud adoption grows. The speaker, a threat researcher, walks through two campaigns analyzed over the past year, continuing an earlier talk on similar families.

The first campaign is Legion, a Python tool sold through a Telegram group. It scans for misconfigured web servers, pulls application secrets from exposed environment files, and tests the mail services those secrets unlock. When it recovers AWS keys, it creates a hidden IAM user with administrator-level permissions and uses Amazon's email service to send test messages. The analysis also covers a bundled PHP exploit and Discord used for campaign reporting. The second campaign is DCOT, a malware-as-a-service group targeting Linux servers. Its execution chains use Go binaries, a modified UPX header that breaks standard unpacking, and shell scripts compiled into executables, along with a scanner, an SSH brute forcer, and a miner.

The session closes with audience questions, including one on Kubernetes; the speaker had not seen Kubernetes-specific campaigns, though serverless-focused malware had appeared. Practitioners should note that exposed configuration files and leaked cloud keys remain a common entry point, and that untagged new IAM users and unexpected Discord webhook traffic are useful signals.