Loading malware…
6 distinct techniques documented for this family, organized by ATT&CK tactic.
If the targeted function runs an affected version of software vulnerable to remote code execution, or if the function’s code itself happens to contain such a vulnerability, then an attacker might discover this and exploit it to run malware.
While Denonia has been clearly designed to target AWS Lambda since it checks for Lambda environment variables prior to its execution, Cado Labs also found that it can be run outside of it in a standard Linux server environment.
That said, the mode of initial access is unknown, although it's suspected it may have involved the compromise of AWS Access and Secret Keys.
While Denonia has been clearly designed to target AWS Lambda since it checks for Lambda environment variables prior to its execution, Cado Labs also found that it can be run outside of it in a standard Linux server environment.
Another notable feature of the malware is its use of DNS over HTTPS (DoH) for communicating with its command-and-control server ("gw.denonia[.]xyz") by concealing the traffic within encrypted DNS queries.
Another notable feature of the malware is its use of DNS over HTTPS (DoH) for communicating with its command-and-control server ("gw.denonia[.]xyz") by concealing the traffic within encrypted DNS queries.
Denonia, malware targeting Serverless environments for the purpose of installing cryptominers... An attacker might ... exploit it to run malware such as a cryptominer until the function is configured to timeout.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.