This document describes how CFW defends against common crypto-mining worm attacks in real-world cloud environments. The description focuses on three aspects: defense, detection, and rapid containment after an intrusion.
Prerequisites
Defense against crypto-mining worm attacks is implemented through the Intrusion Defense module of CFW. Currently, the Premium, Enterprise, and Ultimate editions all support the Intrusion Defense feature, which can defend against crypto-mining attacks. However, common crypto-mining attacks are typically launched from hosts in the private network after they are infected with malware such as trojans or botnets. To accurately locate the at-risk hosts within the private network, you need to enable the NAT Firewall feature. Therefore, it is recommended that your CFW edition be Premium, Enterprise, or Ultimate.
How Mining Worms Spread
Crypto-mining worms primarily spread by exploiting network vulnerabilities. Vulnerabilities are generally categorized into common vulnerabilities and 0-DAY/N-DAY vulnerabilities.
Common Vulnerability Exploitation
Crypto-mining worms typically exploit common vulnerabilities that are widespread in applications or websites, such as code flaws, configuration errors, and weak passwords in business systems. They launch persistent scanning and attack activities over the internet to infect hosts. Common attack methods that leverage these generic vulnerabilities include: SSH/RDP brute-force password cracking, command injection attacks, credential stuffing attacks, Webshell communication, and connections to malicious external hosts. Common intrusion methods via generic vulnerabilities are shown in the following table:
Intrusion Type
Representative Family
Typical Intrusion Method
Brute-force Attack Category
MyKingsMrbMinerLoggerMinerGuardMinerDDG RDPMiner
MongoDB brute-force attack
SSH brute-force attack
Tomcat brute-force attack
MySQL brute-force attack
PostgreSQL brute-force attack
SQL Server brute-force attack
FTP brute-force attack
RDP brute-force attack
SMB brute-force attack
Telnet brute-force attack
Zero-Day/N-Day Vulnerability Exploitation
After a 0-DAY or N-DAY vulnerability is disclosed, if it remains unpatched during the temporary window before a fix is available, it can easily lead to widespread propagation and infection, causing significant damage to applications or business operations.
Common 0-DAY/N-DAY vulnerabilities primarily include: WebLogic vulnerability exploitation, deserialization vulnerability exploitation, EternalBlue, Tomcat remote code execution vulnerabilities, and others.
Common intrusion methods that exploit 0-DAY/N-DAY vulnerabilities are shown in the following table:
CFW performs real-time detection on traffic passing through it. If malicious characteristics, such as those of crypto-mining worms, are detected in the traffic, CFW can automatically block it to defend against crypto-mining worm attacks. This defense is specifically reflected in the following two aspects:
Defending Against Common Vulnerabilities
Attacks that exploit generic vulnerabilities are often carried out through methods such as RDP/SSH brute-force cracking and system command injection. You can defend against such attacks using the Basic Defense module within the Intrusion Defense feature of CFW. Basic Defense incorporates intrusion detection rules accumulated from Tencent Cloud's extensive experience in offensive and defensive security practices. These rules cover common network attack types and malicious code. The details are as follows:
Enable the Basic Defense feature to defend against attacks from crypto-mining worms that exploit generic vulnerabilities. The specific steps to enable it are as follows:
1. Log in to the CFW console. In the left-side navigation, click Intrusion Defense.
2. On the Intrusion Defense page, click
to enable the Threat Intelligence and Basic Defense switches, and select the protection mode as Block Mode or Strict Mode.
Note:
In Observation Mode, detected crypto-mining worm activities are not automatically blocked but are recorded in the Alarm Center.
In Block Mode, the Threat Intelligence module supports automatically blocking unauthorized external connections, and the Basic Defense module supports automatically blocking high-confidence alarms.
In Strict Mode, any alarms detected by the Threat Intelligence and Basic Defense modules are automatically blocked or added to the blocklist.
If popular 0-DAY and N-DAY vulnerabilities are not patched in a timely manner, the risk of being exploited and infected by crypto-mining worms is high. CFW leverages the Tencent Cloud Intelligence Center to obtain vulnerability intelligence in real time. This enables CFW to promptly discover 0-DAY and N-DAY vulnerabilities, acquire their Proof of Concept (POC) details at the earliest opportunity, and implement them to build a virtual patch rule library. This process allows CFW to gain a critical time advantage in the offensive and defensive battle against hackers. The details are as follows:
Enable the Virtual Patch switch to defend against crypto-mining worm attacks that exploit 0-DAY/N-DAY vulnerabilities. The specific steps are as follows:
1. Log in to the CFW console. In the left-side navigation, click Intrusion Defense.
2. On the Intrusion Defense page, click
to enable the Virtual Patch switch, and select the protection mode as Block Mode or Strict Mode.
Tencent Cloud Threat Intelligence can detect malicious outbound traffic in real time. It incorporates Tencent Security's global threat intelligence detection to accurately identify traffic accessing malicious source IPs or dangerous domains, with updates occurring automatically within seconds. For both public network and private network assets, all traffic passing through CFW is inspected. If crypto-mining worm attack traffic is detected, the host is marked as compromised and displayed in the Alarm Center.
How to Use CFW for Rapid Containment After a Breach
If a server has been successfully compromised by a crypto-mining worm, you can use CFW to quickly locate the at-risk hosts, and then use Cloud Workload Protection to scan and remove the malware from the infected hosts. This helps prevent risks such as malicious file uploads by hackers and information leakage.
For public network assets, the Internet Boundary of CFW can identify them. If a public network asset is infected by a crypto-mining worm, Threat Intelligence can immediately locate the compromised asset, and automatically block the threat.
For private network assets, which require address translation to access the Internet, CFW can only locate the translated public IP address. Therefore, if a private network asset is infected by a crypto-mining worm, you need to add the private network asset to the NAT Firewall. The Alarm Center will then alert you that the translated public IP address has accessed a mining pool's IP address or domain. You can then use that IP address or domain to search the traffic logs of the NAT Firewall to identify which specific private network asset is exhibiting the crypto-mining worm behavior, thereby achieving the goal of locating the source host.
Proactively configure Access Control rules for blocking. When Intrusion Defense detects which host has initiated crypto-mining behavior to the Internet, if it is a public network asset, you can configure a blocking rule in Access Control > Internet Border Rule > Outbound Rule.
If it is a VPC asset, you can configure a blocking rule in Access Control > NAT Border Rule > Outbound Rule.
