“Denonia,” a recently discovered Go-based wrapper, has been observed by Cado Security researchers to be “specifically developed to target Amazon Web Services (AWS) Lamba cloud environments.” Denonia deploys “a custom XMRig cryptominer,” that mines for Monero cryptocurrency and utilizes “newer address resolution techniques,” for command-and-control (C2) communications in order to bypass detection measures and virtual network access controls. Though the researchers have yet to determine the method of deployment for Denonia via the actors responsible, there is speculation that leaked or stolen AWS Access and Secret keys have been utilized and then manually deployed into the compromised cloud environments. The researchers noted that this method has been used previously to deliver Python scripts that then run cryptominers. Also, Denonia execution has the ability to continue outside of a Lamba environment, “due to Lamba ‘serverless’ environments using Linux under the hood,” despite the malware being specifically developed for the AWS environment. CTIX analysts will continue to monitor Denonia as it continues to evolve in its early stages and will provide updates as they become available.