Attacker Targets Hadoop YARN, Flint Servers in Stealthy Campaign

Aqua Nautilus researchers observed attacks exploiting known misconfigurations in Hadoop YARN and Apache Flink to remotely execute code and deploy packed ELF payloads that install rootkits and a Monero cryptominer; the adversary used cron job deletion/creation, /tmp wiping, packed and stripped ELF binaries, permission changes, and dual rootkits to persist and evade detection on high-CPU big-data servers, raising risks of resource abuse, lateral movement, and potential data exposure.