# Pause off my cluster: DERO cryptojacking takes a new shape

Misconfigured Kubernetes API servers with anonymous auth granted non-default permissions let attackers deploy DERO-mining containers disguised as legitimate pause/device-plugin workloads.

- Payout: Real-world hack
- Severity: high
- Program: Kubernetes
- Analysis by: Wiz Research
- Disclosed: 2024-06-07
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/dero-cryptojacking-campaign-adapts-to-evade-detection
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-dero-cryptojacking-campaign-adapts-to-evade-detection
- Tags: area:cloud domain:cloud domain:infra impact:dos impact:internal-access kind:incident platform:threat-intel sev:high tech:docker tech:kubernetes technique:default-creds vuln:access-control vuln:misconfiguration

**Target:** Internet-facing Kubernetes API server with anonymous authentication and over-permissive anonymous roles
**Root cause:** Anonymous authentication was enabled and the system:anonymous user / system:unauthenticated group was bound to non-default permissions, letting unauthenticated users create workloads. Attackers then deployed miner containers with benign-looking names.
**Steps:**
1. Reach an externally accessible Kubernetes API server with anonymous auth enabled; unauthenticated requests map to `system:anonymous` in `system:unauthenticated`.
2. Confirm the anonymous user has non-default permissions allowing workload creation (e.g. list `/version` works, then attempt deploy).
3. Create deployments/daemonsets with masquerading names like `k8s-device-plugin` in `kube-public` and `pytorch-container` in `kube-system`, using images `nohuppo:pause`, `dockerproxies/pause`, `pausehubs:pause`.
4. Container entrypoint runs `./pause`, a UPX-packed DERO miner with hardcoded encrypted wallet and pool URLs, so no suspicious CLI flags appear.
5. Miner connects to `community-pools.mysrv[.]cloud` or `*.windowsupdatesupport[.]link` subdomains to mine DERO to attacker wallets.
**How found:** Incident investigation of customer cloud environments; IOCs from the incident were pivoted in VirusTotal to find related Windows miners and a dropper script (ddns.sh) that kills competing miners, downloads GMiner or a payload, and persists via bash profiles.
**Exploitation:** Attacker used anonymous access to an Internet-facing cluster API to deploy five miner workloads across control-plane namespaces, blending with legitimate pause/device-plugin containers. Miners ran with hardcoded wallet/pool config to avoid detectable arguments; Docker Hub images had 10,000+ pulls. No lateral movement to the wider cloud was observed.
**Insight:** Anonymous auth alone is benign; the toxic combination is anonymous auth plus any non-default role binding to system:anonymous/system:unauthenticated. Hunt for clusters where anonymous users can create pods/deployments, and watch for miner containers masquerading as pause or NVIDIA device-plugin in kube-system/kube-public.

## Proof of concept (copied exactly from the original report)

**Malicious image entrypoint.sh executing pause miner**

```
#!/bin/bash

echo "ok"

sleep 10

./pause
```