FortiGuard Labs is aware of a report that a new malware is designed to run in compromised AWS Lambda environments. Started in 2014, AWS Lambda is a serverless compute service of Amazon Web Services (AWS) and runs code as a response to events, which some refer to as Function as a Service (FaaS). Written in Go, Denonia malware contains and runs a customized version of the XMRig cryptocurrency mining software in memory.Why is this Significant?This is significant as Denonia appears to be the first malware that is crafted to run in AWS Lambda environments. Since AWS Lambda is widely used, another Lambda specific malware can emerge and potentially perform other malicious activities.How was Denonia Malware Deployed in AWS Lambda?The attack vector has not been identified. What is Denonia Malware Designed to Perform in AWS Lambda?Upon infection, Denonia executes XMRig miner in memory, and communicates with the attacker’s Mining pool.What is the Status of Coverage?FortiGuard Labs provide the following coverage against Denonia malware:Adware/MinerRiskware/ApplicationAll network IOCs are blocked by the WebFiltering client.
USN-5331-1 fixed several vulnerabilities in tcpdump. This update provides
the corresponding update for Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.
Original advisory details:
It was discovered that tcpdump incorrectly handled certain inputs.
An attacker could possibly use this issue to cause a denial of service,
or possibly execute arbitrary code. (CVE-2018-16301)
It was discovered that tcpdump incorrectly handled certain captured data.
An attacker could possibly use this issue to cause a denial of service.
(CVE-2020-8037)
