Worm rubs out competitor's malware, then takes control
Copyright (c) 2024 kungfu01/Shutterstock. No use without permission.
All your compromised credentials are belong to us now instead of the other gang
There’s a mysterious framework worming its way through exposed cloud instances removing all traces of TeamPCP infections, but it’s not benevolent by a long shot: Whoever is behind this bit of malware may be cleaning up who came before, but only so they can take their place.
Discovered by security outfit SentinelOne’s SentinelLabs researchers and dubbed PCPJack for its habit of stealing previously compromised systems from TeamPCP, the worm was first spotted in late April hiding among a Kubernetes-focused VirusTotal hunting rule. It stood out from known cloud hacktools, said SentinelLabs, because the first action it always takes is to eliminate tools associated with TeamPCP attacks.
The script didn’t stop there, though.
“We initially considered that this toolset could be a researcher removing TeamPCP’s infections,” SentielLabs said. “Analysis...
Copyright of this story solely belongs to theregister.com. To see the full text click HERE
