TF-MAL-elf.cloud_snooper
📛 Threat Title
Malware family: Cloud Snooper
Description
ThreatFox malware family `elf.cloud_snooper`. Printable name: Cloud Snooper. Aliases: Snoopy.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.senthorus.ch
Cloud Snooper - rootkit A hallmark of the most sophisticated attackers -Possibly Nation-State sponsored-
-
web:darkmarc.substack.com
The Cloud Snooper attack is a method for attackers to maintain hidden command-and-control (C2) access to compromised cloud servers, targeting AWS EC2 instances.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the Cloud Snooper malware family including references, samples and yara signatures.
-
web:techfeed.io
In the course of investigating a malware infection of cloud infrastructure servers hosted in the Amazon Web Services (AWS) cloud , SophosLabs discovered a sophisticated attack that employed a unique combination of techniques to evade detection and that permits the malware to communicate freely with its command and control (C2) servers through a firewall that should, under normal circumstances ...
-
web:threats.wiz.io
Cloud Snooper is a malware targeting both Linux and Windows servers, including those hosted on Amazon Web Services (AWS). It employs a rootkit to establish a backdoor, enabling attackers to bypass firewall restrictions and communicate with compromised systems via covert channels. The malware inspects incoming HTTP and HTTPS traffic, identifying specially crafted packets that signal commands ...
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.manageengine.com
How to detect and defend against Cloud Snooper attack? Collecting and analyzing logs from your cloud environment can help you detect these IoCs at an early stage and minimize damage. Cybersecurity solutions such as a security information and event management (SIEM) tool can detect and mitigate these attacks with real-time alerts, automatic remediation workflows, anomaly detection, and more ...
-
web:www.ncnonline.net
Sophos published a SophosLabs report on Cloud Snooper , a sophisticated attack that uses a unique combination of techniques to allow malware on servers to communicate freely with its command and control servers through firewalls. The report deconstructs the tactics, techniques and procedures (TTPs) used in the attack.
-
web:www.securityweek.com
A threat actor — likely a state-sponsored cyberespionage group — has used a sophisticated technique to allow a piece of malware hosted on a server to communicate with command and control (C2) servers through a firewall. The attack was spotted by Sophos, which has named the method used by the hackers " Cloud Snooper ." The company came across the attack while investigating a malware ...
-
web:www.sophos.com
The Cloud Snooper communications handler The central piece of the attack is a file named snd_floppy - a kernel module that sets up a network packet filter, using a Netfilter hook (NF_INET_LOCAL_IN and NF_INET_LOCAL_OUT). This component was instrumental in giving the malware's operators the ability to communicate with the malware , despite the firewall protecting the AWS EC2 servers. The NF ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.