Cryptomining Campaign Exploiting Grid Services
Essential information
- Published
- 30/07/2024 15:45
- Modified
- 30/07/2024 16:30
- Tags
- 2024-07-30 cryptomining grid selenium threat webdriver xmrig
- Related entities
- 14 observables, 7 techniques (mitre), 1 malware
Description
Wiz researchers discovered an ongoing threat campaign, dubbed 'SeleniumGreed', that exploits exposed Selenium Grid services for cryptomining. The campaign targets publicly accessible instances of Selenium Grid, an integral component of the widely used Selenium testing framework. By leveraging features of Selenium WebDriver API, the threat actor executes remote commands, deploys a modified XMRig miner, and employs various techniques to evade detection and maximize mining efforts.