Financially motivated

SCARLETEEL

SCARLETEEL illustrated as a eel

SCARLETEEL is a financially motivated cloud operation tracked by Sysdig that breaches AWS accounts through vulnerable containers and compute services. It steals credentials and escalates to administrator in the account. It runs cryptominers and also steals proprietary data.

Cloud tradecraft

  • Steals credentials from IMDSv1 and IMDSv2 on compromised containers
  • Finds AWS keys in the filesystem and inside Docker containers
  • Uses Pacu and AWS CLI to find privilege escalation paths
  • Escalates to AdministratorAccess by exploiting weak IAM policies
  • Creates new IAM users and access keys for persistence
  • Spins up EC2 instances to mine Monero

MITRE ATT&CK techniques

T1078.004T1552.005T1552.001T1098.001T1136.003T1496

References

Prevent these techniques in your AWS accounts

Pathbreak validates which of these techniques resolve against your real AWS authorization and gives you the change that breaks each path, so an attacker cannot chain it.

Request a free scan Browse the attack map