[Guest Diary] Building Better Defenses: RedTail Observations from a Honeypot, (Thu, Oct 9th)
Source SANS ISC Handlers Diary
Description
&#;x26;#;x5b;This is a Guest Diary by Jin Quan Low, an ISC intern as part of the SANS.edu Bachelor&#;x26;#;39;s Degree in Applied Cybersecurity (BACS) program &#;x26;#;x5b;1].]
Impact
For European organizations, RedTail poses a significant risk primarily through the unauthorized consumption of computing resources, leading to degraded system performance and increased electricity and hardware costs. While it does not cause immediate disruption like ransomware, the persistent cryptojacking can reduce operational efficiency and potentially shorten hardware lifespan. Organizations with exposed SSH services and weak credential policies are particularly vulnerable. The stealthy persistence mechanisms and defense evasion tactics complicate detection and remediation efforts, increasing the risk of prolonged compromise. Critical infrastructure and enterprises relying on Linux/Unix servers for essential services may experience indirect impacts if resource contention affects service availability or response times. Additionally, the presence of unauthorized SSH keys and outbound connections to malicious pools could be leveraged by attackers for further lateral movement or data exfiltration, although no direct evidence of such activity was observed. The financial impact, while indirect, accumulates over time and can be substantial for large-scale deployments. The threat also highlights the importance of continuous monitoring and incident response capabilities to detect and mitigate such stealthy intrusions.
Defensive guidance
1. Enforce SSH key-based authentication exclusively and disable password-based logins to prevent brute-force attacks. 2. Implement rate limiting and automatic lockouts for repeated SSH login failures using tools like fail2ban. 3. Disable root login over SSH (PermitRootLogin no) and remove or restrict unnecessary services to reduce attack surface. 4. Regularly apply security patches and updates to all exposed systems to close known vulnerabilities. 5. Segment networks to isolate honeypots and exposed systems from production environments, limiting lateral movement. 6. Block or sinkhole known malicious mining pool IP addresses and domains at the network perimeter. 7. Enable detailed logging for SSH access, process creation, and outbound network connections, focusing on detecting anomalies such as unauthorized SSH keys and unusual systemd services. 8. Monitor system resource usage (CPU, memory, disk I/O) for sustained abnormal spikes indicative of cryptomining activity. 9. Deploy TTP-based detection rules aligned with MITRE ATT&CK to identify brute-force attempts, persistence mechanisms, and command and control traffic. 10. Establish rapid incident response procedures to isolate compromised hosts, remove attacker SSH keys, terminate mining processes, and rebuild systems from trusted images. 11. Use honeypots and threat intelligence feeds to stay updated on evolving RedTail TTPs and incorporate them into detection strategies. 12. Conduct regular security awareness training emphasizing the risks of weak credentials and the importance of secure SSH practices.
Summary
RedTail is a cryptojacking malware first observed in early 2024 that targets systems to mine Monero cryptocurrency by hijacking CPU resources. The malware typically gains initial access through brute-force attacks against SSH services or by exploiting vulnerabilities to deploy malicious scripts. Once inside, attackers execute setup scripts (setup.sh) to configure the mining environment and clean scripts (clean.sh) to remove competing cryptomining processes, ensuring exclusive resource use. Persistence is maintained by implanting attacker-controlled SSH keys into the authorized_keys file, allowing re-entry without repeated brute-force attempts. To evade detection, attackers delete files and logs that could reveal their presence. The malware communicates outbound over HTTPS (port 443) to malicious mining pool servers, blending with normal traffic. The attack lifecycle maps comprehensively to the MITRE ATT&CK framework: reconnaissance via IP scanning, weaponization and staging of malware, delivery through brute-force SSH login, execution of shell scripts, persistence via SSH key manipulation, defense evasion through file deletion, system discovery to confirm compatibility, command and control via web protocols, and impact through resource hijacking. The stealthy nature of RedTail means it often goes unnoticed, causing subtle but continuous degradation of system performance and increased operational costs. The malware’s adaptability is evident as different hashes have been observed, making signature-based detection less effective. The honeypot observations highlight the importance of focusing on TTPs rather than just IOCs for detection. RedTail’s activity underscores the ongoing risk posed by weak SSH credentials and unpatched vulnerabilities in exposed systems.