- Security scientists are viewing new campaign targeting Docker -Business
- The attack exposes a cloud -cryptomins and a worm for further propagation
- Miner generates the Dero currency
Hackers build a botnet out of incorrectly configured Docker API occurrences and use it to mines dero cryptocurrency, experts have warned.
Kaspersky security researchers reported having found a “container zombie outbreak” that started with an exposed Docker API.
“This led to the current containers being compromised, and new ones were created not only to hijack the victim’s resources for cryptocurrency mining, but also to launch external attacks to spread to other networks,” they explained.
Negotiations on an ongoing basis?
In this zombie outbreak, “Patient Zero” is an incorrectly configured API open to the Internet. That inserts the striker a piece of malware disguised as ‘NGINX’, a high -performance, open source web server and vice versa proxy server.
Malware scans for vulnerable instances and infects them, then creates new malicious containers and forces existing to my dero. At the same time, it continues to spread to other systems.
This is a two -step process, explains Kaspersky. NGINX is the reproductive tool that scans for new victims where mines are a cloud -based solution. Both components are written in Golang, making them quite difficult to detect.
Kaspersky also says that unlike traditional cryptojacking campaigns, this one does not depend on a command and control (C2) server, but instead spreads autonomously as a worm.
Users running Docker must check their API settings and make sure it is not exposed to the Internet. In addition, they should consolidate their login credentials and perform regular security audits and monitoring.
While cyber criminals usually hijack servers to my moneros with xmrig, this is not the first time scientists discovered dero. According to Hacker the newsCrowdstrike saw Kubernetes clusters that were targeted back in March 2023, and a subsequent iteration of the same campaign was discovered by Wiz in June 2024.
Like Monero, Dero is also a privacy -focused layer 1 blockchain, built to support decentralized applications (DAPPS) and smart contracts.
Via Hacker the news
