Subj : Docker API targeted by cryptojacking campaign looking to build me
To   : All
From : TechnologyDaily
Date : Tue Oct 01 2024 19:15:05

Docker API targeted by cryptojacking campaign looking to build mega botnet

Date:
Tue, 01 Oct 2024 18:13:00 +0000

Description:
Someone has been targeting unlocked, internet-connected Docker Engine APIs, 
and using them to deploy XMRig malware.

FULL STORY
======================================================================

Hackers have been spotted using the Docker Engine API to target various 
containers with cryptojackers and other malware . 

Cybersecurity researchers at Datadog, who recently observed one such campaign 
and reported on it in an in-depth analysis, noted the criminals first looked 
for internet-exposed Docker Engine APIs that are not password-protected, 
using different internet scanning tools. 

Then, they used the Docker API to spawn an Alpine container, and mount the 
underlying hosts file system inside the container. The next step is to 
execute a shell command to pull an initialization script that effectively 
kickstarts the infection chain. No evidence of abuse 

The Docker Engine API is a Docker-provided interface that allows developers 
and systems to interact with the Docker daemon, programmatically. Via the 
API, users can manage and control Docker containers, networks, and images, 
all through HTTP requests. 

The chain starts with data transfer tools which, in turn, deploy XMRig. This 
is a popular cryptojacker, a tool that uses the compromised devices computing 
power to generate cryptocurrency tokens and send them to the attackers wallet 
address. 

After that, the attackers deploy a few scripts to hide the presence of XMRig, 
after which they go for additional payloads that allow them to move 
laterally. Other Docker Swarm, Kubernetes, and SSH servers are targeted, and 
ultimately assimilated into an actor-controlled Docker Cluster. 

The cluster allows the crooks to use Docker Swarms orchestration features for 
command and control tasks. 

At press time, the researchers have not yet identified the group behind this 
campaign. The tactics, techniques, and procedures (TTP) of this campaign do 
overlap with the ones usually used by TeamTNT, they suggested. 

"This campaign demonstrates that services such as Docker and Kubernetes 
remain fruitful for threat actors conducting cryptojacking at scale," Datadog 
said, before adding that as long as these APIs remain online without proper 
protection, they will be considered low-hanging fruit to crooks. 

 Via The Hacker News More from TechRadar Pro Malware attacks on Docker Hub 
spread millions of malicious repositories Here's a list of the best firewalls 
around today These are the best endpoint security tools right now



======================================================================
Link to news story:
https://www.techradar.com/pro/security/docker-api-targeted-by-cryptojacking-ca
mpaign-looking-to-build-mega-botnet


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.