GitLab has been exploited to launch a novel proxyjacking attack

Crypto mining
Kryptovaluuttojen louhinta on tehokkainta oikeilla komponenteilla. (Image credit: Shutterstock / Yevhen Vitte)

There is an ongoing hacking campaign targeting GitLab servers vulnerable to a known flaw, researchers are saying. The goal of the campaign is proxyjacking and crypojacking.

Earlier this week, cybersecurity researchers from Sysdig published a report, detailing a novel threat actor they named LABRAT. This group has gone above and beyond to stay hidden, deploying cross-platform malware, kernel rootkits, and numerous obfuscation techniques, as well as abusing legitimate cloud services as much as possible.

The report reads: “This operation was much more sophisticated than many of the attacks the Sysdig TRT typically observes... the stealthy and evasive techniques and tools used in this operation make defense and detection more challenging.”

Sophisticated campaign

To successfully compromise endpoints, the attackers are abusing CVE-2021-22205. This is a two year-old improper validation vulnerability that has a severity score of 10.0. 

It was found in three separate versions of GitLab - 13.8.8, 13.9.6, and 13.10.3, but a patch has been available since April 2021. The campaign once again underlines the importance of frequent patching and keeping both software and hardware up to date.

When the attackers find a vulnerable endpoint and establish persistence, they will go for either proxyjacking, or cryptojacking. The former is the practice of renting out unused victim bandwidth to a proxy network and earning money in the process. 

The latter, on the other hand, refers to installing cryptocurrency miners on vulnerable devices, without the owner’s knowledge or consent. 

Cryptojackers, while popular among the cybercriminal community, are relatively easy to spot. As mining crypto requires heavy computing power, the computer can’t work on anything else while it’s active; it will be sluggish and close to unresponsive. Furthermore, victims can expect a highly inflated electricity bill. 

There is no word yet on how successful the campaign really is.

TOPICS

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
A person at a laptop with a cybersecure lock symbol floating above it.
Cybercrime gang targets victims with "triple threat" attacks
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
GitHub Webpage
A cracked malicious version of a Go package lay undetected online for years
Image depicting a hand on a scanner
New Lazarus Group campaign sees North Korean hackers spreading undetectable malware through GitHub and open source packages
An abstract image of digital security.
Hundreds of GitHub repositories hijacked to trick users into downloading malware
A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.
North Korean Lazarus hackers launch large-scale cyberattack by cloning open source software
Latest in Security
Hacker silhouette working on a laptop with North Korean flag on the background
North Korea unveils new military unit targeting AI attacks
An image of network security icons for a network encircling a digital blue earth.
US government warns agencies to make sure their backups are safe from NAKIVO security issue
Laptop computer displaying logo of WordPress, a free and open-source content management system (CMS)
This top WordPress plugin could be hiding a worrying security flaw, so be on your guard
Computer Hacked, System Error, Virus, Cyber attack, Malware Concept. Danger Symbol
Veeam urges users to patch security issues which could allow backup hacks
UK Prime Minister Sir Kier Starmer
The UK releases timeline for migration to post-quantum cryptography
Representational image depecting cybersecurity protection
Cisco smart licensing system sees critical security flaws exploited
Latest in News
Quordle on a smartphone held in a hand
Quordle hints and answers for Sunday, March 23 (game #1154)
NYT Strands homescreen on a mobile phone screen, on a light blue background
NYT Strands hints and answers for Sunday, March 23 (game #385)
NYT Connections homescreen on a phone, on a purple background
NYT Connections hints and answers for Sunday, March 23 (game #651)
Google Pixel 9 Pro Fold main display opened
Apple is rumored to be prioritizing battery life on the foldable iPhone – which could also feature a liquid metal hinge for added durability
Google Pixel 9
The Google Pixel 10 just showed up in Android code – and may come with a useful speed boost
L-mount alliance
Sirui joins L-Mount Alliance to deliver its superb budget lenses for Leica, DJI, Sigma and Panasonic cameras