Labrat Campaign targets GitLab

Researchers have discovered a new financially motivated threat campaign designed to utilize cryptomining and proxyjacking while staying hidden using a variety of techniques.

The campaign called Labrat, in which the threat actors, compromised a targeted container via legacy GitLab remote code execution vulnerability CVE-2021-22205.

The goal is to make ransom by cryptomining and proxyjacking; the latter being attacks where threat actors rent out a compromised system to a proxy network.

The attacker chose to use undetected compiled binaries, written in Go and .NET, which allowed the attacker to hide more effectively. The attacker abused a legitimate service, TryCloudFlare, to obfuscate their C2 network.

Advertisements

To maintain persistence, the Labrat attackers use a legitimate open-source tool known as Global Socket (GSocket).

Unlike Netcat, GSocket provides features such as a custom relay or proxy network, encryption, and the ability to use TOR, making it a very capable tool for stealthy C2 communications. To remove evidence of its installation, the LABRAT attacker tried to hide the process.

The campaign is ongoing and may even be designed to go beyond proxyjacking and cryptomining, given that the backdoor used provides access to compromised systems, the research team concluded.

This research was documented by researchers from Sysdig, and detailed reports can be found in this link

Indicators of Compromise