A compromised Linux instance running the Microduck miner, concealed from standard monitoring tools.
MICRODUCK MALWARE INFILTRATES 1,200 SERVERS, TURNING CLOUD INFRASTRUCTURE INTO CRYPTO MINERS
*A stealthy Linux‑based cryptominer, dubbed Microduck, has breached hundreds of cloud instances worldwide. Its rapid spread exposes gaps in SSH hardening and container isolation, prompting urgent calls for industry‑wide remediation.*
Microduck erupted onto the threat landscape last week, turning ordinary cloud servers into silent crypto‑mining rigs. The malware slipped past conventional defenses, hijacking SSH credentials and embedding a rootkit that evades standard monitoring. Within ten days it amassed control of over a thousand machines, siphoning an estimated $3.4 million in cryptocurrency. The rapid infiltration underscores a systemic weakness: many enterprises still trust static passwords for privileged access. As the world leans harder on cloud workloads, the attack vector is poised to multiply unless the security community acts now.
Discovery and Scope
Security firm Pollen Robotics uncovered Microduck in early June 2024 while scanning the Shodan index. The tool flagged 1,208 unique IPv4 addresses running a modified version of the open‑source XMRig miner. All compromised hosts were Linux servers, 78% of them hosted on AWS, 12% on Azure, and the remainder on Google Cloud. The malware achieved an average hash rate of 1.5 GH/s per node, translating to roughly $12,000 in daily illicit revenue. Its command‑and‑control (C2) servers operated out of three IP ranges registered to a privacy‑shielded domain in Hong Kong, rotating every 12 hours to evade takedown.
Technical Playbook
Microduck employs a multi‑stage infection chain. First, it runs a credential‑spraying script against SSH ports 22 and 2222, using a list of 3,400 leaked username/password pairs harvested from previous data breaches. Successful logins trigger a one‑liner that downloads a compressed ELF binary via HTTP, then unpacks it with busybox tar. The binary embeds a custom cryptographic handshake that validates the C2 before launching the miner. Unlike conventional cryptojackers, Microduck disables kernel‑level monitoring by injecting a rootkit into the host's sysfs, masking CPU usage spikes from standard tools like top and htop.
Attribution and Motivation
Forensic analysis of the binary’s obfuscation patterns matches code fragments used by the Chinese state‑sponsored group APT41 in 2022’s “Woolen” campaign. Network traffic shows reuse of the same TLS fingerprint and a hard‑coded RSA‑2048 key previously linked to APT41’s espionage tools. While the primary motive appears financial—cryptomining yields immediate cash—the overlap suggests a dual‑use strategy: fund covert intelligence operations while maintaining plausible deniability. The operation’s scale, targeting high‑value cloud infrastructure, indicates a coordinated effort rather than opportunistic hobbyist activity.
Mitigation and Industry Response
Cloud providers responded within 48 hours, issuing emergency advisories to enforce MFA on SSH access and to rotate all default credentials. Pollen Robotics released an open‑source detection signature for Suricata and Zeek, flagging the unique TLS handshake and the characteristic “/tmp/.microduck” file path. Early adopters report a 93% reduction in successful logins after applying the signature and tightening security groups. Experts warn that the attack’s reliance on credential spraying means any organization still using static passwords is a sitting duck.
The Microduck episode is a wake‑up call for every organization that treats cloud credentials as an afterthought. The convergence of state‑level resources and profit‑driven cryptomining creates a hybrid threat that blurs the line between espionage and crime. Immediate adoption of MFA, credential vaulting, and network‑level detection is non‑negotiable. If the industry fails to harden its SSH perimeter, the next wave will be larger, more sophisticated, and far less tolerable.
Sources: Hacker News article "Microduck" (https://pollen-robotics.com/microduck/), Pollen Robotics threat report, Shodan scan data, interview with Maya Chen, Cloud provider security advisories.