'Commando Cat' Is Second Campaign of the Year Targeting Docker
The threat actor behind the campaign is still unknown, but it shares some similarities with other cyptojacking groups.
![A black cat with its paws on a computer keyboard A black cat with its paws on a computer keyboard](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt84fc46f9278e9b25/6583411cc37f3d0407fe4f59/black_cat_Saro_o_Neal_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
In findings released by Cado researchers, they discovered a malware campaign, coined "Commando Cat," which is targeting exposed Docker API endpoints.
The cryptojacking campaign has only been active since the beginning of this year but it's the second one targeting Docker. The first one used the 9hits traffic exchange application, according to the researchers. However, these Docker attacks aren't necessarily rare, especially in cloud environments.
"This campaign demonstrates the continued determination attackers have to exploit the service and achieve a variety of objectives," the researchers said. "Commando Cat is a cryptojacking campaign leveraging Docker as an initial access vector and (ab)using the service to mount the host's filesystem, before running a series of interdependent payloads directly on the host."
It is unclear who the threat actor behind Commando Cat is or where they're from, though there is an overlap in scripts and IP addresses to other groups like Team TNT, indicating a potential connection or a copycat.
Because of the level of redundancy and the amount of evasion, the campaign is sophisticated in how it conceals itself. Acting as a credential stealer, backdoor, and cryptocurrency miner together as one, it makes for a highly stealthy and malicious threat.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024