Threat Actors leverage Docker Swarm and Kubernetes to mine cryptocurrency at scale
Essential information
- Published
- 25/09/2024 12:43
- Modified
- 25/09/2024 13:10
- Tags
- 2024-09-25 container security cryptojacking docker docker swarm kubernetes xmrig
- Related entities
- 41 observables, 18 techniques (mitre), 1 malware
Description
A new cryptojacking campaign targeting Docker Engine API has been discovered, with the ability to move laterally to Docker Swarm, Kubernetes, and SSH servers. The attackers exploit exposed Docker API endpoints to deploy cryptocurrency miners and additional malicious payloads. They utilize Docker Hub to host malicious images and leverage Docker Swarm's orchestration features for command and control purposes. The campaign employs various techniques for lateral movement, persistence, and evasion, including manipulating Docker Swarm, exploiting Kubernetes' kubelet API, and installing backdoors. While some indicators suggest a possible link to TeamTNT, there is insufficient evidence for definitive attribution.