Attackers Say ‘Hello’ to a Different Scale of Cloud Attack

Researchers dubbed an attack chain “Greeter” after discovering that attackers deliberately covered their trail by leaving “hello” messages in logs.

What began as an exploratory Shodan search for exposed cloud instances has led to the discovery of a broad-ranging AI infrastructure attack campaign that researchers have christened “Greeter.” The campaign, which started life as an organized, multistage, systematic attack across cloud providers, reinforces why defenders need to shift their thinking about cloud security to include a layered model built around network access control, data protection, and identity security.

Era Security researchers kicked off the research when the Shodan search engine revealed open Amazon DynamoDB instances where anyone could download data or delete it entirely. They dug a little deeper and found Flowise, a connected open source GenAI development platform, where users can build AI agents powered by large language models (LLMs).

Unpatched Flowise Instances Attract Hordes of Attackers

Roughly 90% of the nearly 3,000 scanned Flowise deployments were running unpatched versions vulnerable to a critical code-injection vulnerability, CVE-2024-58351 — and if the researchers could see it, so could attackers. So, Era Security deployed AI-powered honeypots, mostly on Amazon Web Service (AWS), to catch them in action.

Honeypot technology is “not like it was before,” and attackers don’t recognize it’s a decoy until they’re much further into the environment, according to the Era Security research team. In the past, it took three or fourth months to build a realistic honeypot. Today, it’s two hours.

“The most important finding wasn’t the exploitation technique itself, but it was what happened after,” Naor Talmor, chief technology officer (CTO) at Era Security, tells Dark Reading. What ensued was a repeatable, staged methodology where attackers mapped out privileges and the environment, hunted for credentials, exploited cloud metadata services across multiple providers to escalate access, and then locked in persistence, he explains. Attackers also obfuscated their activity by leaving seemingly benign and fleeting “hello” messages in the logs, making detection much more difficult because it requires team to spend time searching for specific indicators of compromise in the logs. Thus, the researchers gave the campaign the “Greeter” moniker.

The sophisticated techniques and persistence show that Greeter isn’t an opportunistic smash-and-grab attack, a script kiddie, or someone who had merely stumbled upon the honeypots, the researchers noted. And, the campaign was deployed across several AWS regions at once, which indicates broader scale and intent.

Era Security warns of the potential scale the campaign could reach, confirming 46 real-world victims so far, based on the number of unauthenticated instances that mirrored the honeypot conditions. The team estimates that at least 50% of those remain connected to the Internet and visible, suggesting at least 20 organizations are currently exposed. The sophistication levels of the the threat actors also speaks to how how valuable the cloud and AI attack surface has become, given the effort required to launch Greeter; this wasn’t low-hanging fruit.

How Greeter Says Hi to Wider Industry Concerns

The Greeter campaign signals a few shifts across the cloud landscape, including how much easier it’s gotten for attackers to go unnoticed in workflows. Much of that is due to AI, which threat actors are using to assist in writing code or orchestrating attack steps, according to the Greeter attack logs.

A decade ago, cloud attacks targeted the Docker API. Threat actors then began exploiting workloads, escaping containers to reach the cloud’s metadata server underneath, and exploiting service accounts from there, the researchers explain. While attackers are following a similar pattern, they are now using AI infrastructure as the new way to establish persistence.

Researchers agree that the end goal on each instance was to grab cloud credentials and perform lateral movement within a targeted organization.

Meanwhile, attribution remains quite challenging. When the researchers drilled down to the code and techniques, they started to see Chinese characters, though that could be a false flag. Still, a nation-state culprit would make since, because the notion of seeing an “entire orchestration, not even a big cybercrime group could execute that,” according to Era Security.

Defense Isn’t Just About the Vulnerability

The current velocity of vulnerability exploitation is nothing like the researchers have seen in the past, which puts immense pressure on organizations’ traditional patching cycles. This played out just over the past few weeks alone, as security teams raced to fix PHP2Shell and OpenSSH, searching workloads one by one for flaws. However, the Greeter campaign shows a defense challenge for cloud security that’s bigger than fixing any specific vulnerability.

Everyone needs to assume a breach now, warns Talmor, adding how if it’s not a vulnerability, it may be leaked credentials or an exposed API. Organizations need to design security programs around the cloud to be ready for all of the above, he advises, adopting defense-in-depth.

“A lot of companies adopt that, but they don’t really practice it,” he notes.

The researchers say organizations can detect this kind of attack much faster if teams monitor for enumeration activity to close gaps before attackers find them. When applications or chat tools are installed, logging can be activated and streamed to a separate location so that even if attackers do delete a device’s local history, the logs remain stored in the cloud.

Researchers also noted that this should be monitored closely in critical environments, especially where crown jewels or critical applications are involved, adding that organizations can have dozens or hundreds of accounts depending on the size.

“To be clear, we aren’t saying, ‘Stop caring about misconfigurations or stop caring about vulnerabilities,” Talmor says, warning that patch management is a game “we are losing” that requires organizations to secure their environment layer by layer.

Originally published on Dark Reading