• Lateral Tool Transfer
• Escape To Host
• Remote System Discovery
• North America
• Smb/Windows Admin Shares
• Unix Shell
• Network Service Discovery
• Change Default File Association
• Docker
• Business Services
• External Remote Services
• Match Legitimate Name Or Location
• Ingress Tool Transfer
• Exploitation For Client Execution
• Resource Hijacking
• Exploit Public-Facing Application
• United States
• Obfuscated Files Or Information
• Deploy Container
• Web Protocols

Cryptojacking Campaign Targets Misconfigured Docker APIs

A new malware campaign has emerged, targeting misconfigured Docker API instances to create a cryptocurrency mining botnet focused on mining Dero currency. The threat actor exploits insecurely published Docker APIs to gain access to running containerized infrastructures, propagating the malware through a worm-like mechanism to infect other exposed Docker instances. The attack utilizes two main components: a propagation malware named 'nginx' that scans for vulnerable Docker APIs, and a 'cloud' Dero cryptocurrency miner. This campaign has been linked to previous cryptojacking operations and poses a significant risk to any network with insecure Docker APIs.