9/8/25, 6:24 PM

On 2 January 2024, Darktrace’s researchers reported a novel cryptojacking campaign dubbed “Commando Cat” that targets exposed Docker API endpoints, marking it as the second Docker-focused campaign of 2024 after the 9hits incident. The malware uses Docker as an initial access vector to mount the host filesystem and run interdependent payloads on the host, including backdoors and credential exfiltration alongside a cryptominer payload.

Initial access involves an exposed Docker API instance pulling a image named cmd[.]cat/chattr from a remote C2, deploying scripts that create two backdoors and a persistent foothold via SSH keys and a dedicated user, and then deploying TinyShell and gs-netcat backdoors to maintain access.

The campaign also delivers a base64-encoded payload to deploy an XMRig miner and to “secure” the docker install, while actively evading detection through process hiding, container manipulation, and by using memory-backed execution paths. Attacks are facilitated by the IP 45.9.148[.]193, which acts as the command-and-control host, and the campaign is noted for its extensive evasion and multi-stage payloads. according to Cado Security labs (now part of Darktrace).