Microsoft Azure Machine Learning Clusters Hijacked To Mine Monero

The Microsoft Azure machine learning clusters were recently compromised and hijacked by attackers who repurposed them to mine the privacy coin Monero (XMR). This is a viral topic in the cryptocurrency news today and as we can see, Microsoft is not happy with it.

On June 10, the tech giant said that it had discovered a number of cryptojacking attacks on powerful machine-learning clusters on its Azure cloud computing network. A blog post details that the company said some customers had misconfigured nodes, allowing attackers to hijack them to mine the privacy-oriented cryptocurrency Monero (XMR).

Microsoft said that it had discovered tens of clusters that are affected by the attack, which targets machine learning toolkit Kubeflow for the open-source Kubernetes platform. By default, this dashboard (that controls Kubeflow) is only accessible internally which is how the Microsoft Azure machine learning clusters were compromised.

Users modifying the port-forwarding to tunnel in via the Kubernetes API had modified this and directly exposed the dashboard to the Internet. With access to this dashboard, attackers had a number of available vectors through which they compromised the system.

One possibility is to set up or modify the Jupyter notebook server in the cluster with a malicious image. As the Azure Security Center team discovered, there was a suspect image from a public repository on a number of machine learning clusters.

The team realized that the Microsoft Azure machine learning centers ran an XMRig miner to use the node to mine Monero (XMR). As you know from our Monero news, there are many scams associated with the coin mostly because of the fact that transactions in XMR cannot be traced (hence it is known as privacy coin).

For those of you unfamiliar with machine learning clusters, they are essentially a powerful tool that sometimes contains GPUs, making them the ideal target for cryptojackers. Earlier reports from the cyber security firm Sophos revealed that attackers had breached vulnerable Microsoft SQL Server databases to install the same XMRig software that uses Monero.

Meanwhile, the price of Monero (XMR) in the news now posts new losses, trading at $65.55 with a 4.62% decline on the day and a market cap of $1.15 billion. If this downward trend continues, XMR is expected to go below the $60 level.