Gafgyt Malware Targeting Cloud Environments (Campaign)

Gafgyt (Bashlite) has a new variant targeting cloud-native environments by brute-forcing weak SSH credentials to load two in-memory binaries: an SSH scanner and an XMR cryptominer that uses GPU acceleration. The campaign prioritizes resource control by killing competing processes, alters system configuration (e.g., /etc/sysctl.conf), and removes logs/history to avoid detection; researchers observed cloud-specific usernames like "AWS" and "Azure" in brute-force attempts and recommend searching for indicators of compromise.