🚀 New Linux Malware Threatens Docker Infrastructure
#Linux #Malware #Docker #Cryptojacking #Cybersecurity #Kaspersky #Dero #Golang #Virtualization #Containers #Kubernetes
According to Foresight News, a report by cybersecurity firm Kaspersky has revealed a new Linux malware activity targeting insecure Docker infrastructures. This threat is turning exposed servers into part of a decentralized cryptojacking network mining the privacy coin Dero.
The attack exploits the publicly accessible Docker API on port 2375. Once access is gained, the malware generates malicious containers, infecting running containers to steal system resources for mining Dero. It also scans for other targets without needing a central command server. Docker, from a software perspective, is a set of applications or platform tools and products that use operating system-level virtualization to deliver software in small packages known as containers.
The threat actors behind this operation have deployed two Golang-based implants: one named "nginx," which is deliberately disguised as legitimate web server software, and another called "cloud," which is the actual mining software for generating Dero. Once a host is compromised, the nginx module continuously scans the internet for more vulnerable Docker nodes, using tools like Masscan to identify targets and deploy new infected containers.
To evade detection, the malware encrypts configuration data, including wallet addresses and Dero node endpoints, and hides itself in paths typically used by legitimate system software. Kaspersky found that the wallet and node infrastructure used in earlier cryptojacking activities targeting Kubernetes clusters in 2023 and 2024 are the same, indicating an evolution of a known operation rather than a completely new threat.#Linux #Malware #Docker #Cryptojacking #Cybersecurity #Kaspersky #Dero #Golang #Virtualization #Containers #Kubernetes
🚀 Hackers Exploit DevOps Tool Vulnerabilities for Cryptocurrency Mining
#Hackers #DevOps #Cybersecurity #Cryptocurrency #Mining #Vulnerabilities #CloudSecurity #ConfigurationManagement #XMRig #SecurityUpdate #API #HashiCorp #Docker #Gitea
According to PANews, security firm Wiz has identified a hacker group, codenamed JINX-0132, that is exploiting configuration vulnerabilities in DevOps tools for large-scale cryptocurrency mining attacks. The tools targeted include HashiCorp Nomad/Consul, Docker API, and Gitea, with approximately 25% of cloud environments at risk.
The attack methods involve deploying XMRig mining software using Nomad's default configuration, executing malicious scripts through unauthorized Consul API access, and controlling exposed Docker APIs to create mining containers. Wiz's data indicates that 5% of DevOps tools are directly exposed to the public internet, with 30% having configuration flaws.
Security teams recommend users promptly update software, disable unnecessary features, and restrict API access permissions to mitigate risks. This attack highlights the importance of cloud environment configuration management. Despite warnings from HashiCorp's official documentation about related risks, many users have not enabled basic security features. Experts emphasize that simple configuration adjustments can prevent most automated attacks.#Hackers #DevOps #Cybersecurity #Cryptocurrency #Mining #Vulnerabilities #CloudSecurity #ConfigurationManagement #XMRig #SecurityUpdate #API #HashiCorp #Docker #Gitea