Financial Cloud Threat Alert: Slim Spider Steals Crypto Custody Secrets from Brazilian Financial Institution
Executive Summary
Threat intelligence analysts at CrowdStrike have revealed details of a sophisticated, targeted intrusion campaign conducted by a previously undocumented cybercrime cluster tracked as Slim Spider (The Hacker News). Operating out of Brazil, the financially motivated adversary demonstrated specialized operational knowledge of national financial systems—including the Pix instant payment infrastructure, digital asset management platforms, and cloud banking architectures. In a major attack on a Brazilian financial institution, Slim Spider weaponized custom Bash scripts against cloud Instance Metadata Services (IMDS) to siphon temporary IAM credentials, subsequently exfiltrating cryptocurrency custody private keys and digital asset signing secrets.
Deep-Dive Technical Analysis
Cloud Metadata Interception & Custody Vault Compromise
Modern FinTech and digital asset custody platforms rely on cloud environments (such as Amazon Web Services and Google Cloud) to manage transactions, API integrations, and cryptographic signature services. CrowdStrike's forensic investigation details Slim Spider's multi-stage attack lifecycle:
1. Initial Access via Vulnerable Web Services: Slim Spider achieved initial entry into the financial institution's cloud perimeter by exploiting an unpatched web application vulnerability on an external-facing customer portal.
2. Local Cloud Metadata Abuse: Once inside the underlying cloud instance, the attackers deployed custom Bash scripts designed to query the local cloud Instance Metadata Service (IMDS at 169.254.169.254) over raw socket connections. Because the institution had not enforced session-token requirements (IMDSv2), the scripts successfully retrieved temporary cloud IAM role credentials associated with the running virtual machine.
3. Privilege Escalation & Cloud Reconnaissance: Armed with valid cloud IAM tokens, the attackers enumerated the organization's cloud environment, identifying Amazon S3 data lakes, relational database services (RDS), and containerized microservices managing digital asset transactions.
4. Targeting Pix & Crypto Custody Infrastructure: Demonstrating intimate familiarity with Brazilian banking frameworks, the threat actors focused reconnaissance on systems supporting Brazil's Pix instant payment rail and digital asset custody operations. The group located and dumped unencrypted configuration files, cold/hot wallet master keys, transaction-signing API tokens, and internal database tables.
5. Covert Exfiltration & Asset Draining: Stolen private keys and payment parameters were exfiltrated via encrypted egress channels to attacker-controlled cloud servers, enabling the adversary to initiate unauthorized fund transfers and drain digital asset custody pools while bypassing traditional fraud detection baselines.
Financial Sector Cloud Risk & Non-Human Identity Exploitation
The Slim Spider intrusion underscores key structural vulnerabilities in modern financial cloud security:
* The Peril of Legacy IMDSv1: Legacy metadata endpoints that permit tokenless GET requests remain a primary attack vector for server-side request forgery (SSRF) and local privilege escalation in cloud environments.
* Over-Privileged Cloud Roles: Granting virtual machines broad access to sensitive digital asset vaults without strict field-level encryption or hardware security module (HSM) isolation allows an initial perimeter foothold to escalate into a catastrophic custody compromise.
Actionable Recommendations & Mitigations
1. Mandate AWS IMDSv2 Cloud-Wide: Enforce IMDSv2 across all cloud instances by setting HttpTokens=required and configuring HttpPutResponseHopLimit=1. This blocks unauthorized tokenless metadata queries and prevents containerized workloads from accessing host metadata.
2. Isolate Cryptocurrency Keys in Hardware Security Modules (HSMs): Never store digital asset private keys, wallet seed phrases, or signing secrets in plaintext configuration files or standard cloud databases. Enforce FIPS 140-2 Level 3 Hardware Security Modules (HSMs) or Multi-Party Computation (MPC) custody architectures for all transaction signing.
3. Implement Least-Privilege IAM Scoping: Audit and restrict IAM roles attached to compute instances. Ensure that application workloads processing Pix or digital asset transactions possess only granular, strictly scoped permissions with short token lifetimes.
4. Deploy Egress DLP & Metadata Query Monitoring: Configure cloud security monitoring (e.g., AWS GuardDuty / CloudTrail) to alert on high-frequency metadata service requests and unexpected outbound transfers from transaction processing subnets.
________________
Sources & References: The Hacker News.