New Malware Exploits Exposed Docker APIs to Gain Persistent Root SSH Access

A new strain of malware uncovered by the Akamai Hunt Team targets exposed Docker APIs, with first observations in August 2025 within Akamai’s honeypot infrastructure. It differs from the June 2025 Trend Micro report by blocking other attackers from accessing the Docker API and delivering a modular payload rather than a cryptominer.

The June 2025 activity saw a Base64 downloader fetched via Tor that installed curl and torsocks, retrieved an XMRig miner, modified /etc/ssh/sshd_config to permit root login, added an attacker’s public key to /root/.ssh/authorized_keys, and scheduled a cron job to persist SSH access and run the miner.

Akamai’s variant achieves persistent SSH root access and introduces API lockdown, with a script that reconfigures root SSH access and continually blocks port 2375 using a minute‑by‑minute cron routine to thwart rivals. The campaign also deploys a modular Go-based dropper via Tor, uses Masscan to identify more Docker APIs, and includes dormant Telnet and Chrome Debugging modules for future expansion, posting scan results to a Tor‑hosted C2 endpoint.

Mitigations emphasise monitoring Docker API interactions, alerting on connections to ports 2375, 9222 and 23 from untrusted networks, inspecting new containers for host filesystem mounts, and securing Docker with network segmentation and least privilege.