Loading story…
Researchers identified Denonia, a Go-based 64-bit ELF malware strain described as the first known malware observed targeting AWS Lambda in the wild. The binary masquerades as python and contains a customized version of the XMRig cryptocurrency miner, indicating the operators aimed to hijack serverless compute resources for illicit mining rather than exploit a flaw in Amazon's platform itself.
Analysis found that Denonia checks for AWS Lambda environment variables before running and uses DNS over HTTPS to contact its command-and-control domain, gw.denonia[.]xyz, helping it evade traditional network monitoring and controls. Investigators said the initial access vector remains unknown but likely involved compromised AWS credentials instead of an AWS vulnerability, while Amazon stated that Lambda is secure by default and that the malware does not abuse any weakness in Lambda or other AWS services.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
A 64-bit ELF Denonia sample masquerading as "python" was uploaded to VirusTotal. The Go-based malware contained a customized XMRig cryptocurrency miner and checked for AWS Lambda environment variables before execution.
A Denonia sample named "bc50541af8fe6239f0faa7c57a44d119.virus" was uploaded to VirusTotal. Researchers later linked it to the malware family targeting AWS Lambda.
Amazon stated that Lambda remained secure by default and that the malware did not exploit any weakness in Lambda or other AWS services. The company said the activity instead relied on fraudulently obtained account credentials.
Cado Labs discovered and analyzed Denonia, describing it as the first malware observed in the wild targeting Amazon Web Services' Lambda serverless platform. The malware used DNS over HTTPS for command-and-control traffic and appeared likely to rely on compromised AWS credentials rather than an AWS vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coordinated cryptocurrency mining campaign has been detected targeting Amazon Web Services (AWS) customers by exploiting compromised Identity and Access Management (IAM) credentials. The attackers used these credentials to gain unauthorized access to Amazon Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) environments, rapidly deploying crypto mining operations within minutes of initial access. Amazon GuardDuty and AWS's automated security monitoring systems identified the campaign, which began on November 2, 2025, and observed the use of novel persistence techniques designed to disrupt incident response and prolong mining activities. The attackers operated from external hosting providers, quickly enumerating service quotas and permissions before launching mining resources, and in some cases, created dozens of ECS clusters in a single attack. The threat actors employed advanced tactics such as using the "DryRun" flag with the RunInstances API to validate permissions without launching instances, minimizing their forensic footprint. They also created new IAM roles and attached policies to facilitate the deployment and persistence of mining workloads. AWS emphasized that the campaign did not exploit vulnerabilities in AWS services themselves but relied on the misuse of valid credentials, underscoring the importance of strong credential management and monitoring. AWS has provided mitigation guidance and detection recommendations to help customers defend against similar attacks in the future.
Jun 29, 2026
Researchers reported that the **Lucifer** malware evolved from a Windows-based cryptominer into a cross-platform threat targeting **Windows, Linux, and IoT devices** with a mix of **Monero mining, DDoS, command-and-control, and remote execution** capabilities. Check Point linked Lucifer to the earlier **BlackSquid** and **Rudeminer/Spreadminer** activity through shared code traits and Monero wallet overlaps, indicating the operators had likely been active since 2018 and were continuing to release new variants. The campaign hit more than **25 organizations** across the **United States, Ireland, the Netherlands, Turkey, and India**, including victims in **manufacturing, legal, insurance, and banking**. The malware spread by exploiting known flaws—especially **`CVE-2018-10561`** in **Dasan GPON routers**—along with older Windows exploits and brute-force attacks. Researchers said Linux samples supported mining and full C2 functions, while ARM and MIPS variants were used mainly for DDoS operations, underscoring Lucifer's shift into a broader hybrid malware platform.
Aug 14, 2026
Threat actors targeted **Huawei Cloud Elastic Cloud Service (ECS)** instances with an upgraded Linux malware set designed for cryptojacking and broader cloud compromise. The operation deliberately interfered with Huawei Cloud defenses by disabling security-related services such as **hostguard** and abusing the `cloudResetPwdUpdateAgent` plugin, indicating environment-specific tradecraft rather than generic Linux opportunism. The attackers also sanitized infected systems by removing competing malware, deleting rival users and SSH keys, creating stealthy privileged accounts, installing **Tor**, and establishing persistence. The campaign deployed two main payloads: an obfuscated ELF backdoor, `linux64_shell`, which used a **CrossC2/Cobalt Strike-compatible** library to communicate with command-and-control infrastructure, and a Go-based scanner, `xlinux`, built on the **kunpeng** framework to spread further. The scanner searched for weak credentials and exploitable services, including **Oracle WebLogic** systems vulnerable to `CVE-2020-14882`, underscoring how cloud misconfigurations and poor credential hygiene continued to provide a path for cryptojacking-focused intrusions.
Aug 14, 2026