Beyond Cryptominers: A New Malware Strain Is Hijacking Exposed Docker APIs

Akamai has uncovered a new malware strain that hijacks exposed Docker APIs, marking a shift from earlier cryptomining-focused campaigns to broader infection capabilities, including persistence, port blocking, and potential botnet groundwork. The lineage traces back to June 2025, when Trend Micro reported a cryptominer that used misconfigured Docker APIs to deploy malware behind Tor, dropping a Base64 payload in new containers, modifying SSH and installing tools such as masscan and torsocks.

By August 2025, Akamai researchers observed a variant that drops a file containing other tools rather than a miner, with infection capabilities extending beyond the original strain; according to Akamai Hunt Team, the binary is different and lacks a cryptominer.

The new strain is launched through an HTTP request to Docker APIs that starts a container based on Alpine, where a Base64-decoded script installs Tor and fetches docker-init[.]sh from a Tor hidden service; Stage 1 installs curl and Tor, Stage 2 retrieves the script.

The script adds the attacker’s public key to /root/.ssh/authorized_keys, establishes persistence with cron jobs, and blocks port 2375 on the host, effectively owning the victim for exclusive use, while the Go-based binary dockerd drops further tools and uses masscan to locate other exposed Docker APIs to propagate.

The package also contains dormant Telnet and Chromium modules, hinting at future expansion into a broader botnet; Akamai notes these indicate an early version of a more extensive operation, with detection and prevention strategies focusing on restricted API exposure, unusual package installs, and monitoring for specific port activity. According to the Akamai Hunt Team, this variant represents an initial version of a complex botnet, though a full version has not yet been observed.