Denonia Malware Targets AWS Lambda With Cloud-Specific Crypto Mining

Researchers identified Denonia, a Go-based 64-bit ELF malware strain described as the first known malware observed targeting AWS Lambda in the wild. The binary masquerades as python and contains a customized version of the XMRig cryptocurrency miner, indicating the operators aimed to hijack serverless compute resources for illicit mining rather than exploit a flaw in Amazon's platform itself.

Analysis found that Denonia checks for AWS Lambda environment variables before running and uses DNS over HTTPS to contact its command-and-control domain, gw.denonia[.]xyz, helping it evade traditional network monitoring and controls. Investigators said the initial access vector remains unknown but likely involved compromised AWS credentials instead of an AWS vulnerability, while Amazon stated that Lambda is secure by default and that the malware does not abuse any weakness in Lambda or other AWS services.