Kubernetes and Cloud SQL Vulnerabilities Exposed in Sophisticated Cryptocurrency Heists

Post Views: 108

Cyberattack on Cryptocurrency Organization Exposes Cloud Infrastructure Vulnerabilities

A sophisticated cyberattack on a cryptocurrency organization has exposed the vulnerabilities of cloud infrastructure and the importance of robust security measures.

Attack Overview

The attack, attributed to a suspected North Korean threat group, began with a social engineering tactic that tricked a developer into installing a malicious file on their personal device.

Once the attackers gained access to the developer’s machine, they executed embedded malicious Python code that installed a binary disguised as the Kubernetes command-line tool.

This allowed them to establish a foothold in the system and connect to an attacker-controlled domain, enabling remote access and reconnaissance of the company’s cloud infrastructure.

Attack Chain

The attackers then pivoted to the organization’s Google Cloud environment, using authenticated sessions and available credentials to gather information about the company’s cloud services and internal projects.

They modified the multi-factor authentication policy of a bastion host, a secure server used to manage access to protected systems, to gain further access to the environment.

With this access, the attackers manipulated the organization’s DevOps infrastructure, altering Kubernetes deployment configurations to ensure persistence within the system.

They also targeted the continuous integration and continuous deployment platform, injecting commands that exposed service account tokens in system logs and gaining access to a high-privileged CI/CD service account.

Privilege Escalation and Data Exfiltration

The attackers used the stolen service account credentials to authenticate to a sensitive infrastructure pod operating in privileged mode, breaking out of container restrictions and deploying another backdoor to maintain persistent access.

They then extracted database credentials stored insecurely within environment variables inside a Kubernetes pod and used them to connect to the production database through the Cloud SQL Auth Proxy.

Once inside the database, the attackers executed SQL commands that altered user account settings, including password resets and updates to multi-factor authentication seed values associated with several high-value accounts.

With control over these accounts, the attackers withdrew digital assets worth several million dollars.

“The attack, attributed to the UNC4899 threat group, highlights the risks posed by peer-to-peer data transfer between personal and corporate devices, privileged container environments, and the insecure storage of secrets in cloud deployments.”

Conclusion

The attack chain, described as a “living-off-the-cloud” operation, blended social engineering with cloud-specific exploitation techniques, relying on legitimate tools and infrastructure features to maintain persistence and evade detection.

The incident serves as a reminder of the importance of vigilance and proactive security measures in protecting against sophisticated cyber threats.