A recent discovery by the Sysdig Threat Research Team (TRT) has unveiled a malicious campaign preying on the blockchain-based Meson service, just ahead of its planned token unlock on March 15. The attack, characterized by the rapid creation of 6000 Meson Network nodes, has set off alarms for multiple AWS users and highlighted vulnerabilities within cloud infrastructure.
Swift Infiltration and Costly Consequences
The attacker’s strategy involved exploiting CVE-2021-3129 in a Laveral application and misconfigurations in WordPress to gain initial access to a compromised cloud account. From there, they utilized automated reconnaissance techniques to escalate privileges and deploy numerous EC2 instances across various regions. Ultimately, the execution of the meson_cdn binary incurred significant costs for the account owner.
Unlike traditional crypto-hacking incidents, where high CPU and memory usage are prominent, the Meson application displayed relatively low resource consumption. This deviation is attributed to the unique workings of the Meson Network, which focuses on establishing an efficient bandwidth marketplace on Web3.
Shift in Attacker Priorities
The attack on Meson sheds light on a shift in attacker priorities, moving away from CPU-centric crypto mining towards resource-intensive operations. In the context of Meson, attackers prioritize storage space and high bandwidth to reap financial gains, reflecting the evolving landscape of blockchain-based threats.
Precautionary Measures and Recommendations
Sysdig emphasizes the importance of keeping software up to date and monitoring environments for suspicious activity to mitigate the risk of falling victim to similar attacks. As the Meson network gains traction in the blockchain domain, vigilance, and proactive security measures become paramount for organizations and individuals involved in cryptocurrency ventures.
The emergence of attacks targeting storage space and high bandwidth underscores the need for enhanced cybersecurity measures within the blockchain ecosystem. By remaining vigilant and implementing robust security protocols, stakeholders can safeguard their assets and mitigate the impact of malicious campaigns such as the recent exploit targeting Meson.
