{
  "name": "Nearly 20% of Docker Hub Repositories Spread Malware & Phishing Scams",
  "slug": "nearly-20-of-docker-hub-repositories-spread-malware-phishing-scams",
  "description": "This report details an investigation by JFrog Security researchers on a coordinated attack on Docker Hub, where millions of malicious repositories were planted to spread malware and phishing scams. It analyzes three major malware campaigns, dubbed 'Downloader', 'eBook Phishing', and 'Website SEO', that exploited Docker Hub's repository documentation feature. The report provides insights into the attackers' tactics, techniques, and infrastructure, highlighting the challenges of moderating open platforms.",
  "published": "2024-05-01T17:59:42+00:00",
  "created_at": "2024-05-01T17:59:42+00:00",
  "modified_at": "2024-05-02T09:13:39+00:00",
  "created_at_opencti": "2024-05-01T17:59:42+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "campaigns",
    "docker hub",
    "freehtmlvalidator.exe",
    "phishing",
    "repositories"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "https://urlgo.in/"
      },
      {
        "id": "",
        "name": "https://urlin.us/2vwNSW"
      },
      {
        "id": "",
        "name": "https://gohhs.com/'+c"
      },
      {
        "id": "",
        "name": "https://gohhs.com/'"
      },
      {
        "id": "",
        "name": "http://soneservice.shop/new/net_api"
      },
      {
        "id": "",
        "name": "http://rd.lesac.ru/"
      },
      {
        "id": "",
        "name": "http://failhostingpolp.ru/9ebeb1ba574fb8e786200c62159e77d15UtXt7/x60VKb8hl1YelOv1c5X1c0BuVzmFZ8-teb-LRH8w"
      },
      {
        "id": "",
        "name": "http://blltly.com/1w1w1"
      },
      {
        "id": "",
        "name": "rd.lesac.ru"
      },
      {
        "id": "",
        "name": "vittuv.com"
      },
      {
        "id": "",
        "name": "urluss.com"
      },
      {
        "id": "",
        "name": "urluso.com"
      },
      {
        "id": "",
        "name": "urloso.com"
      },
      {
        "id": "",
        "name": "urllio.com"
      },
      {
        "id": "",
        "name": "urllie.com"
      },
      {
        "id": "",
        "name": "urlgoal.com"
      },
      {
        "id": "",
        "name": "urlin.us"
      },
      {
        "id": "",
        "name": "urlgo.in"
      },
      {
        "id": "",
        "name": "urlca.com"
      },
      {
        "id": "",
        "name": "urlcod.com"
      },
      {
        "id": "",
        "name": "tweeat.com"
      },
      {
        "id": "",
        "name": "tlniurl.com"
      },
      {
        "id": "",
        "name": "totrakto.com"
      },
      {
        "id": "",
        "name": "tiurll.com"
      },
      {
        "id": "",
        "name": "tinurll.com"
      },
      {
        "id": "",
        "name": "tinurli.com"
      },
      {
        "id": "",
        "name": "tinourl.com"
      },
      {
        "id": "",
        "name": "ssurll.com"
      },
      {
        "id": "",
        "name": "soneservice.shop"
      },
      {
        "id": "",
        "name": "shurll.com"
      },
      {
        "id": "",
        "name": "shoxet.com"
      },
      {
        "id": "",
        "name": "picfs.com"
      },
      {
        "id": "",
        "name": "miimms.com"
      },
      {
        "id": "",
        "name": "ltlly.com"
      },
      {
        "id": "",
        "name": "jinyurl.com"
      },
      {
        "id": "",
        "name": "imgfil.com"
      },
      {
        "id": "",
        "name": "gts794.com"
      },
      {
        "id": "",
        "name": "gohhs.com"
      },
      {
        "id": "",
        "name": "geags.com"
      },
      {
        "id": "",
        "name": "fancli.com"
      },
      {
        "id": "",
        "name": "cinurl.com"
      },
      {
        "id": "",
        "name": "bytlly.com"
      },
      {
        "id": "",
        "name": "bltlly.com"
      },
      {
        "id": "",
        "name": "blltly.com"
      },
      {
        "id": "",
        "name": "2fexample.us"
      },
      {
        "id": "",
        "name": "byltly.com"
      }
    ],
    "attack_patterns": [
      {
        "id": "1eb0f7a1-c251-459c-9d0d-b0da60b75fc8",
        "name": "T1092"
      },
      {
        "id": "384655c4-b8b6-4062-93f3-bfe57dd27370",
        "name": "T1107"
      },
      {
        "id": "6c54bb5e-b90c-478e-b1fb-705daf1869b3",
        "name": "T1197"
      },
      {
        "id": "fe6f2946-a01e-460c-9636-8c48b45dd0e6",
        "name": "T1189"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "870bd958-53a3-4d25-9f23-00aa8bd6674d",
        "name": "T1102"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "358e04b8-6f65-48b2-a24b-f101bfc6671a",
        "name": "T1195"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://jfrog.com/blog/attacks-on-docker-with-millions-of-malicious-repositories-spread-malware-and-phishing-scams/",
    "https://otx.alienvault.com/pulse/66329f2e6378bd16250f5a4e"
  ]
}