Denonia: First Malware Targeting AWS Lambda

Description

FortiGuard Labs is aware of a report that a new malware is designed to run in compromised AWS Lambda environments. Started in 2014, AWS Lambda is a serverless compute service of Amazon Web Services (AWS) and runs code as a response to events, which some refer to as Function as a Service (FaaS). Written in Go, Denonia malware contains and runs a customized version of the XMRig cryptocurrency mining software in memory.

Why is this Significant?

This is significant as Denonia appears to be the first malware that is crafted to run in AWS Lambda environments. Since AWS Lambda is widely used, another Lambda specific malware can emerge and potentially perform other malicious activities.

How was Denonia Malware Deployed in AWS Lambda?

The attack vector has not been identified.

What is Denonia Malware Designed to Perform in AWS Lambda?

Upon infection, Denonia executes XMRig miner in memory, and communicates with the attacker's Mining pool.

What is the Status of Coverage?

FortiGuard Labs provide the following coverage against Denonia malware:

Adware/Miner

Riskware/Application

All network IOCs are blocked by the WebFiltering client.

Appendix

Cado Discovers Denonia: The First Malware Specifically Targeting Lambda (Cado)