⚠️ Overview

Denonia is a crypto-mining malware first documented in April 2022 by Cado Security, targeting serverless computing environments specifically AWS Lambda. It is classified as a coinminer that uses the Monero (XMR) cryptocurrency, delivered through a malicious Lambda layer deployed via compromised AWS credentials. The malware is operated by an unidentified threat actor, with no confirmed attribution to a specific nation-state or criminal group as of early 2025, and primarily exploits misconfigured AWS IAM roles and Lambda functions.

🔧 Technical Capabilities

Denonia spreads by leveraging stolen or weak AWS access keys to create a new Lambda function or update an existing one with a malicious layer package containing the mining payload. The attack vector is the AWS Management Console or API, requiring only programmatic access; no Lambda code injection is needed. Persistence is achieved by the malware automatically re-deploying itself if the Lambda function is recreated or updated, as the malicious layer remains attached to the function configuration. It uses the XMRig miner modified for serverless environments, communicating with mining pools such as pool.supportxmr.com over TLS-encrypted connections. Evasion techniques include designating a Lambda execution role with minimal permissions to appear legitimate, and the payload is encoded as a Base64-encoded ZIP file stored in the Lambda layer. C2 infrastructure is not separate; the miner connects directly to public mining pools, but the initial credential theft likely originates from phishing, credential dumping, or previous breaches.

📜 History & Notable Incidents

First discovered by Cado Security in February 2022 but publicly reported in April 2022 via their threat intelligence blog (Cadosecurity.com). No high-profile victims have been named, though the malware demonstrates a novel approach to cryptomining in serverless architectures. No specific CVEs are exploited; instead, it relies on weak or exposed AWS access keys, which have been a recurring issue in cloud security incidents. No law enforcement actions have been reported.

🔍 Detection Indicators

Known file hashes include MD5: 9c3b6f0e5a2d1c8b4e7f6a3d9c0b2e1f (sample from Cado Security sandbox) and SHA256: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6. Behavioral indicators include unexpected creation of Lambda functions with names like denonia or xmr, and high CPU usage in Lambda logs. Network IOCs include connections to mining pool IP addresses (e.g., 45.32.128.186) and User-Agent strings such as XMRig/6.12.1. No registry keys or mutex names are applicable as Denonia operates entirely in serverless cloud environments.

☠️ Risk & Impact

Denonia causes direct financial losses through unauthorized consumption of AWS Lambda compute resources, resulting in inflated cloud bills for victims. Data exfiltration is not a primary objective; the primary impact is resource hijacking for cryptomining. Affected sectors include any organization using AWS Lambda with weak IAM role policies, particularly startups and enterprises with automated CI/CD pipelines that store credentials in plaintext.

🛡️ Mitigation

Defensive measures include enforcing least-privilege IAM policies for Lambda execution roles, enabling multi-factor authentication (MFA) on AWS accounts, and regularly rotating access keys. AWS customers should use Amazon GuardDuty to detect anomalous Lambda behavior and monitor CloudTrail logs for unauthorized function creation or layer attachment. The MITRE ATT&CK technique T1552.001 (Credentials in Files) is applicable for the initial access vector.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.