Docker API targeted by cryptojacking campaign looking to build mega botnet
Hackers target unlocked, internet-connected Docker Engine APIs
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Hackers have been spotted using the Docker Engine API to target various containers with cryptojackers and othermalware.
Cybersecurity researchers at Datadog, who recently observed one such campaign and reported on it in an in-depth analysis, noted the criminals first looked for internet-exposed Docker Engine APIs that are not password-protected, using different internet scanning tools.
Then, they used the Docker API to spawn an Alpine container, and mount the underlying host’s file system inside the container. The next step is to execute a shell command to pull an initialization script that effectively kickstarts the infection chain.
No evidence of abuse
The Docker Engine API is a Docker-provided interface that allows developers and systems to interact with the Docker daemon, programmatically. Via the API, users can manage and control Docker containers, networks, and images, all through HTTP requests.
The chain starts with data transfer tools which, in turn, deploy XMRig. This is a popular cryptojacker, a tool that uses the compromised device’s computing power to generate cryptocurrency tokens and send them to the attacker’s wallet address.
After that, the attackers deploy a few scripts to hide the presence of XMRig, after which they go for additional payloads that allow them to move laterally. Other Docker Swarm, Kubernetes, and SSH servers are targeted, and ultimately assimilated into an actor-controlled Docker Cluster.
The cluster allows the crooks to use Docker Swarm’s orchestration features for command and control tasks.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
At press time, the researchers have not yet identified the group behind this campaign. The tactics, techniques, and procedures (TTP) of this campaign do overlap with the ones usually used by TeamTNT, they suggested.
“This campaign demonstrates that services such as Docker and Kubernetes remain fruitful for threat actors conducting cryptojacking at scale,” Datadog said, before adding that as long as these APIs remain online without proper protection, they will be considered “low-hanging fruit” to crooks.
ViaThe Hacker News
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Windows PCs targeted by new malware hitting a vulnerable driver
Dangerous Android banking malware looks to trick victims with fake money transfers
Apple Mac mini (M4, 2024): the best gets better
