AlienFox, the spammer's friend.

SentinelOne describes “AlienFox,” a toolset designed to steal credentials and API keys from at least eighteen cloud service providers.

AlienFox targets misconfigured servers.

The toolset is being sold on Telegram, and is under active development. AlienFox opportunistically targets misconfigured web servers hosting web frameworks such as Laravel, Drupal, Joomla, Magento, Opencart, Prestashop, and WordPres. The toolkit will then dump the server’s configuration files and extract cloud API keys and secrets. The researchers state that “[t]he spread of AlienFox represents an unreported trend towards attacking more minimal cloud services, unsuitable for cryptomining, in order to enable and expand subsequent campaigns.”

Industry comment.

James McQuiggan, Security Awareness Advocate at KnowBe4, commented: 

"The AlienFox malware is another example of the evolving and persistent threat of cyber attacks. Companies should remain vigilant and proactively protect their sensitive data from malicious actors with proper access controls on their APIs and file permissions on their data, especially using the least user privilege model and implementing MFA on user accounts. Finally, continuous monitoring of suspicious activity will reduce the impact of an attack if discovered.

"Organizations should have multi-layered security measures such as regular software updates, strong password policies, and multi-factor authentication. It's also vital to ensure that organizations are educating their users and developers on the risks of phishing and social engineering attacks that often lead to the installation of malware like AlienFox.

"Developers should implement security best practices like OWASP during the software development lifecycle and conduct regular vulnerability assessments and penetration testing to identify and fix security weaknesses. Additional risk reduction methods include but are not limited to the following:

• "Implementing code reviews can help identify potential issues before they cause problems in production.
• "A release management process will help ensure that only tested and approved changes go into production.
• "Documentation will provide all stakeholders with an understanding of the software and its configuration.

"As API security continues to be a concern for organizations, protecting against various API vulnerabilities and attacks is essential. Consider proper authentication and access controls, like industry-standard protocol or token-based authentication for repeat process requests. Rate limiting can reduce too many requests leading to Denial of Service (DoS) attacks and continuous monitoring. With APIs being available from so many third-party organizations, keeping APIs up to date is crucial. By implementing these best practices, you can reduce the risk of API vulnerabilities and attacks and ensure the security and integrity of your APIs and associated systems."