Attackers deploying new tactics in campaign targeting exposed Docker APIs
Essential information
- Published
- 20/06/2024 12:42
- Modified
- 20/06/2024 13:11
- Tags
- 2024-06-20 chkstart compiler docker docker engine docker host execstartpost exeremo go code mnt directory spinning yarn tencent vurl xmrig miner yarn
- Related entities
- 2 vulnerabilities (cve), 37 observables, 4 techniques (mitre)
Description
Datadog Security Researchers recently encountered a new campaign that targets Docker API endpoints publicly exposed without authentication, with the objective of spreading cryptojacking malware. The observed TTPs bear resemblance to those seen in Spinning YARN, another campaign discovered in March 2024. Based on analysis of the two campaigns and the infrastructure underpinning them, we have made a high-confidence assessment that these campaigns are linked.