Docker API servers being hit to spread cryptomining malware

Date:
Thu, 24 Oct 2024 11:29:00 +0000

Description:
Hackers are on the hunt for vulnerable Docker remote API servers and using them to generate crypto tokens.

FULL STORY ======================================================================

Hackers are targeting vulnerable Docker remote API servers, and using them to mine cryptocurrencies on the underlying hardware, experts have warned.

Cybersecurity researchers from Trend Micro stated the crooks took an unconventional approach with this attack, noting, "the threat actor used the gRPC protocol over h2c to evade security solutions and execute their crypto mining operations on the Docker host."

"The attacker first checked the availability and version of the Docker API, then proceeds with requests for gRPC/h2c upgrades and gRPC methods to manipulate Docker functionalities." Which tokens are they mining?

The experts explained that the crooks would first seek out public-facing Docker API hosts where HTTP/2 protocol can be upgraded. Then, they would send out a request to upgrade to the h2c protocol which, after conclusion, allows them to create a container. That container is ultimately used to mine cryptocurrencies for the attackers, via the SRBMiner payload, hosted on GitHub.

The researchers added the crooks used SRBMiner to mine the XRP token, native to the Ripple blockchain built by the company of the same name. However, XRP is a minted token that cannot be mined. We asked Trend Micro for clarification.

SRBMiner uses algorithms like RandomX, KawPow for mining. It can generate a number of different tokens for its operators, but not XRP. Among the
available tokens are Monero, Ravencoin, Haven Protocol, Wownero, and Firo.

Its safe to assume that the crooks were actually mining Monero, one of the most popular tokens among cybercriminals, given its advanced privacy and anonymity features. Monero is also commonly mined via the XMRig cryptojacker, and its ticker is XRM, quite close to XRP.

Trend Micro warned all users to secure their Docker remote API servers by implementing stronger access controls and authentication mechanisms, thus barring access to unauthenticated individuals. Furthermore, users are advised to monitor the servers for unusual activities, and implement best practices for container security.

Via The Hacker News More from TechRadar Pro Windows and Linux servers turned into crypto miners Here's a list of the best firewalls today These are the best endpoint protection tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/docker-api-servers-being-hit-to-spread- cryptomining-malware


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)