Threats tagged 'container security'

CARBONATO is a Docker botnet discovered by ThreatDown researchers that targets exposed Docker daemons on port 2375. It operates by distributing trojanized cryptocurrency wallet applications and running a botnet infrastructure. The botnet uses a modified Hermes Agent, an open-source AI framework, to execute commands via Telegram, maintain persistence, and harvest credentials. The campaign infrastructure spans multiple hosting providers and has been active from October 2024 through August 2026. No CVE identifiers or official patches are associated with this threat. The severity is medium due to credential theft and botnet control capabilities.

A new Dero mining campaign is infecting containerized Linux environments through exposed Docker APIs. The attack uses two Golang malware components: 'nginx' for propagation and 'cloud' for mining. The 'nginx' malware scans for vulnerable Docker hosts, creates malicious containers, and compromises existing ones. It maintains persistence and spreads without a command-and-control server. The 'cloud' component is a modified DeroHE CLI miner with hardcoded wallet and node addresses. This campaign demonstrates the potential risks of insecurely published Docker APIs and the need for robust container security measures.

Malware#cloud#cryptocurrency miningGermany+6