'Lucifer' Botnet Turns Up the Heat on Apache Hadoop Servers

Aqua Nautilus researchers have observed a multi-phase campaign using the Lucifer botnet to target misconfigured Apache big-data platforms (Hadoop, Druid, Flink). The attackers scanned for vulnerable or misconfigured instances, exploited Hadoop YARN misconfigurations and CVE-2021-25646 in Apache Druid to download and execute Lucifer, which provides cryptomining and DDoS capabilities; the campaign shows testing of evasion techniques and staged delivery to improve persistence and bypass detection.