Docker API targeted by cryptojacking campaign looking to build mega botnet

Date:
Tue, 01 Oct 2024 18:13:00 +0000

Description:
Someone has been targeting unlocked, internet-connected Docker Engine APIs, and using them to deploy XMRig malware.

FULL STORY ======================================================================

Hackers have been spotted using the Docker Engine API to target various containers with cryptojackers and other malware .

Cybersecurity researchers at Datadog, who recently observed one such campaign and reported on it in an in-depth analysis, noted the criminals first looked for internet-exposed Docker Engine APIs that are not password-protected,
using different internet scanning tools.

Then, they used the Docker API to spawn an Alpine container, and mount the underlying hosts file system inside the container. The next step is to
execute a shell command to pull an initialization script that effectively kickstarts the infection chain. No evidence of abuse

The Docker Engine API is a Docker-provided interface that allows developers and systems to interact with the Docker daemon, programmatically. Via the
API, users can manage and control Docker containers, networks, and images,
all through HTTP requests.

The chain starts with data transfer tools which, in turn, deploy XMRig. This is a popular cryptojacker, a tool that uses the compromised devices computing power to generate cryptocurrency tokens and send them to the attackers wallet address.

After that, the attackers deploy a few scripts to hide the presence of XMRig, after which they go for additional payloads that allow them to move
laterally. Other Docker Swarm, Kubernetes, and SSH servers are targeted, and ultimately assimilated into an actor-controlled Docker Cluster.

The cluster allows the crooks to use Docker Swarms orchestration features for command and control tasks.

At press time, the researchers have not yet identified the group behind this campaign. The tactics, techniques, and procedures (TTP) of this campaign do overlap with the ones usually used by TeamTNT, they suggested.

"This campaign demonstrates that services such as Docker and Kubernetes
remain fruitful for threat actors conducting cryptojacking at scale," Datadog said, before adding that as long as these APIs remain online without proper protection, they will be considered low-hanging fruit to crooks.

Via The Hacker News More from TechRadar Pro Malware attacks on Docker Hub spread millions of malicious repositories Here's a list of the best firewalls around today These are the best endpoint security tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/docker-api-targeted-by-cryptojacking-ca mpaign-looking-to-build-mega-botnet


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)