Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks

Aqua Security researchers uncovered a campaign abusing misconfigured Apache Hadoop YARN ResourceManager and Apache Flink instances to perform unauthenticated remote code execution via crafted HTTP requests; the payload is a packed ELF downloader that fetches two rootkits and a Monero cryptocurrency miner, uses cron jobs for persistence, and wipes /tmp to evade detection. The attackers employ packers and rootkits to conceal mining processes; mitigations recommended include agent-based detection for cryptominers, rootkits, packed/obfuscated binaries, and suspicious runtime behaviors.