New Malware Targets Exposed Docker APIs for Cryptocurrency Mining
Researchers studying cybersecurity have discovered a new malware campaign that aims to send bitcoin miners and other payloads via publicly accessible Docket API endpoints.
In a report released last week, cloud analytics platform Datadog stated that among the tools used were a remote access tool with the ability to download and run other dangerous applications as well as a utility to spread the virus via SSH.
Tactical similarities between the effort and Spinning YARN, an earlier initiative that targeted incorrectly configured Apache Hadoop YARN, Docker, Atlassian Confluence, and Redis services for cryptojacking, have been found during campaign analysis.
The threat actors focus on Docker servers that have exposed ports (port number 2375) at the beginning of the assault to launch a ...