Cryptojacking Commando Cat Strikes: How Misconfigured Docker Servers Are Being Hijacked for Monero Mining

A new cryptojacking campaign, dubbed “Commando Cat,” is targeting poorly-secured Docker remote API servers. This feline fiend uses Docker images to deploy cryptojacking scripts, turning your computer into a sluggish, electricity-guzzling mess while it mines cryptocurrency.

Hot Take:

Looks like the Commando Cat is out of the bag, and it’s not here to play with yarn! This feline is on a mission to hijack your CPUs faster than you can say ‘docker run.’

Key Points:

  • Commando Cat campaign targets poorly-secured Docker remote API servers.
  • Uses a Docker image that exploits the chroot command to access the host OS.
  • Deploys ZiggyStarTux, an IRC bot built on the Kaiten malware.
  • Aims to mine cryptocurrency, usually Monero, by using compromised systems.
  • Results in slowed performance and increased electricity bills for victims.

Membership Required

 You must be a member to access this content.

View Membership Levels
Already a member? Log in here