Exposed Docker APIs Likely Exploited to Build Botnet

SecurityWeek reports that threat actors are exploiting exposed Docker APIs to deploy malware and cryptocurrency miners and potentially build a new botnet, according to Trend Micro and Akamai.

The attacks begin with a request to the exposed API to fetch a list of containers, then create a new container from the Alpine image, mount the host root, and execute an encoded payload that starts a shell script to set up the Tor browser in the container and fetch a payload over the Tor network, routing traffic through a socks5h proxy.

Attackers also modify the host’s SSH configuration to gain backdoor access and deploy tools for lateral movement, traffic routing via Tor, and reporting system information to a C&C server. A dropper for an XMRig cryptocurrency miner is deployed with wallet details and pool URLs included. On 8 September, Akamai warned of a variant that blocks external access to the Docker API port 2375 via a cron job that runs every minute, and scans for other open ports such as 23 and 9222 to expand capabilities. Some evidence suggests the variant could form the foundation of a complex botnet, according to researchers.