First malware targeting AWS Lambda's serverless platform discovered

A first-of-its-kind malware strain targeting Amazon Web Services' (AWS) Lambda serverless computing platform has been discovered.

Named Denonia after the domain it contacts, the malware uses newer address-resolution techniques for command-and-control traffic to evade standard detection measures and virtual-network access controls, Cado Labs researcher Matt Muir said.

The artifact analysed by the cybersecurity company was uploaded to VirusTotal on 25 February 2022 under the name python and packaged as a 64-bit ELF executable.

The filename is misleading, however: Denonia is written in Go and includes a customised variant of the XMRig cryptocurrency miner. The initial access method is unknown, although compromised AWS access and secret keys are suspected.

Another notable feature is its use of DNS over HTTPS (DoH) to communicate with its command-and-control server, gw.denonia[.]xyz, hiding traffic within encrypted DNS queries.

In a statement shared with The Hacker News, Amazon stressed that Lambda is secure by default and that AWS continues to operate as designed. Users violating its Acceptable Use Policy (AUP) would be prohibited from using its services.

Although Denonia is clearly designed to target AWS Lambda, checking for Lambda environment variables before execution, Cado Labs also found it can run outside Lambda in a standard Linux server environment.

"The software described by the researcher does not exploit any weakness in Lambda or any other AWS service," the company said. "Since the software relies entirely on fraudulently obtained account credentials, even calling it malware misrepresents the facts, because it cannot gain unauthorised access to any system on its own."

However, python is not the only Denonia sample discovered so far. Cado Labs found a second sample, named bc50541af8fe6239f0faa7c57a44d119.virus, uploaded to VirusTotal on 3 January 2022.

"Although this first sample is relatively harmless because it only runs cryptocurrency-mining software, it shows attackers using advanced cloud-specific knowledge to exploit complex cloud infrastructure, and points to potentially more serious attacks in the future," Muir said.