EXECUTIVE SUMMARY
Recent research has revealed a campaign exploiting Docker and Kubernetes environments to conduct cryptocurrency mining operations across cloud infrastructures. The campaign begins by targeting exposed Docker Engine API endpoints, deploying malicious images hosted on Docker Hub. Once inside, the threat actors leverage Kubernetes APIs and Docker Swarm clusters to expand their reach, moving laterally across compromised systems. The attackers use powerful tools like masscan and zgrab to scan for vulnerable services, enabling them to propagate rapidly and extend control to other related cloud components, including Docker and SSH servers. This sophisticated approach demonstrates a comprehensive effort to compromise and repurpose cloud resources for unauthorized cryptocurrency mining.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
Recent research has revealed a campaign exploiting Docker and Kubernetes environments to conduct cryptocurrency mining operations across cloud infrastructures. The campaign begins by targeting exposed Docker Engine API endpoints, deploying malicious images hosted on Docker Hub. Once inside, the threat actors leverage Kubernetes APIs and Docker Swarm clusters to expand their reach, moving laterally across compromised systems. The attackers use powerful tools like masscan and zgrab to scan for vulnerable services, enabling them to propagate rapidly and extend control to other related cloud components, including Docker and SSH servers. This sophisticated approach demonstrates a comprehensive effort to compromise and repurpose cloud resources for unauthorized cryptocurrency mining.[emaillocker id="1283"]
The campaign’s technical arsenal includes scripts and payloads designed to take over Docker, Kubernetes, and SSH servers. Initially, the attackers exploit Docker API endpoints to gain entry, deploying a malicious Alpine container and mounting host filesystems. Subsequent payloads focus on lateral movement across Kubernetes and Docker Swarm environments, using masscan and zgrab for network scanning, disabling security configurations, and stopping monitoring agents. Kubernetes lateral movement involves compromising the kubelet API, allowing the attacker to deploy further resources and control Kubernetes pods. Docker Hub accounts operated by the attacker distribute malicious images, which, when executed, retrieve, and run additional payloads in memory. This sophisticated setup enables covert mining while utilizing the container orchestration features for command and control.
This campaign exemplifies a dangerous evolution in cloud-based cryptojacking, blending traditional exploitation with modern container orchestration tactics. By leveraging Docker Swarm and Kubernetes for malicious orchestration, attackers maximize their control over compromised environments. Moreover, the attackers’ persistence mechanisms, such as root access establishment and the usage of process-hiding libraries, help conceal their activities. Security teams must address exposed Docker APIs, monitor for suspicious Docker Hub images, and harden Kubernetes and SSH configurations to protect against similar threats. The observed tactics indicate a trend toward using cloud-native tools for illicit purposes, highlighting the need for robust defenses across containerized environments.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Execution | T1059 | Command and Scripting Interpreter |
| Persistence | T1547 | Boot or Logon Autostart Execution |
| T1574 | Hijack Execution Flow | |
| Defense Evasion | T1562 | Impair Defenses |
| T1078 | Valid Accounts | |
| Discovery | T1046 | Network Service Discovery |
| Command and Control | T1572 | Protocol Tunneling |
| Impact | T1496 | Resource Hijacking |
REFERENCES:
The following reports contain further technical details:
https://thehackernews.com/2024/10/new-cryptojacking-attack-targets-docker.html