Dero miner zombies biting through Docker APIs to build a cryptojacking horde
A new Dero mining campaign exploits insecurely published Docker APIs to spread through containerized Linux environments. The attack uses two Golang malware implants: 'nginx' for propagation and 'cloud' for cryptocurrency mining. The 'nginx' malware scans for vulnerable Docker APIs, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' miner is based on the open-source DeroHE CLI project, with hardcoded wallet and node addresses. This campaign differs from previous attacks on Kubernetes clusters by actively spreading and compromising more networks. The threat highlights the importance of securing containerized infrastructures and monitoring for malicious activities.
Pulse ID: 682ddf774e05b30a8adbf3b4
Pulse Link: https://otx.alienvault.com/pulse/682ddf774e05b30a8adbf3b4
Pulse Author: AlienVault
Created: 2025-05-21 14:13:11
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#Cloud #CryptoJacking #CyberSecurity #Docker #Golang #InfoSec #Linux #Malware #Nginx #OTX #OpenThreatExchange #RCE #bot #cryptocurrency #AlienVault
