New 'Greeter' Campaign Uses 'Hello' Messages to Obscure Sophisticated Cloud Attacks
A newly discovered cloud attack campaign, dubbed 'Greeter,' employs subtle log obfuscation techniques and targets unpatched GenAI development platforms, highlighting evolving attacker sophistication in cloud environments.
Researchers have uncovered a sophisticated cloud attack campaign named "Greeter," which systematically targets and exploits unpatched instances of the open-source GenAI development platform Flowise. The campaign's defining characteristic is the attackers' use of "hello" messages embedded within logs to deliberately obscure their malicious activities, making detection significantly more challenging for security teams.
The discovery originated from Shodan searches revealing exposed Amazon DynamoDB instances, which led researchers to Flowise deployments. Investigations by Era Security found that approximately 90% of nearly 3,000 scanned Flowise instances were running vulnerable, unpatched versions susceptible to a critical code-injection flaw, CVE-2024-58351. This widespread vulnerability presented a lucrative target for attackers.
Era Security deployed AI-powered honeypots, primarily on AWS, to observe the exploitation in real-time. The research team noted a significant advancement in honeypot technology, allowing for quicker deployment and more realistic simulations that can deceive attackers for longer periods. The "Greeter" campaign demonstrated a repeatable, multistage methodology, involving privilege mapping, environment reconnaissance, credential hunting, and exploitation of cloud metadata services for access escalation.
Beyond the technical exploitation, the "Greeter" campaign's persistence and obfuscation techniques set it apart. Attackers actively manipulated logs by inserting seemingly innocuous "hello" messages, forcing defenders to sift through extensive data to identify genuine threats. This tactic, combined with the systematic approach across multiple AWS regions, suggests a well-organized and intentional operation rather than opportunistic exploitation.
The campaign's sophistication indicates it is not the work of novice attackers. The effort required to orchestrate such an attack, including the use of AI to assist in code writing and attack sequencing, points towards a more advanced threat actor. Researchers noted that the attack patterns bore resemblance to nation-state capabilities, although attribution remains difficult, with some Chinese characters found in the code potentially serving as a false flag.
Era Security has confirmed 46 real-world victims to date, with an estimated 20 organizations still exposed and connected to the internet. The campaign underscores the increasing value of the cloud and AI infrastructure as an attack surface, given the resources and expertise invested by the threat actors. This campaign signifies a shift from earlier cloud attacks that targeted Docker APIs or container escapes, now leveraging AI infrastructure for persistence.
The "Greeter" campaign highlights a broader challenge in cloud security that extends beyond simply patching specific vulnerabilities. The rapid pace of exploitation and the evolving tactics of attackers necessitate a defense-in-depth strategy that assumes a breach and focuses on continuous monitoring, robust access controls, and secure data protection. Organizations must be prepared for various attack vectors, including exploited vulnerabilities, leaked credentials, or exposed APIs.
To combat such threats, researchers recommend monitoring for enumeration activities to proactively close security gaps. Implementing comprehensive logging, streamed to a separate, secure cloud location, is crucial. This ensures that even if attackers attempt to erase local logs, a record of their activities remains accessible for forensic analysis, particularly in critical environments housing sensitive data or applications.