9/8/25, 7:33 PM

Darktrace’s write‑up on Spinning YARN details a Linux malware campaign that targets misconfigured servers running Docker, Apache Hadoop YARN, Redis and Confluence, exploiting these web-facing services to deploy a cryptocurrency miner and maintain persistence. Researchers note four novel Golang payloads automate the identification and exploitation of the four services, with Confluence being abused via CVE‑2022‑26134 to achieve remote code execution.

The campaign uses a multi‑stage approach, starting with initial access through a Docker Engine API interaction and then delivering shell scripts such as cronb[.]sh, ar[.]sh, s[.]sh and others to install miners, anti‑forensics tools and various rootkits, including libprocesshider and Diamorphine, to hide processes. A notable technique is the creation of Cron jobs and persistence mechanisms, plus the use of an attacker‑controlled SSH key and the deployment of the Platypus reverse shell utility to maintain access.

The researchers document several indicators of compromise, including specific file paths, domain names such as http://b.9-9-8[.]com and IPs, and the staged payloads used to expand the infection chain. The piece also notes historical context, linking these tactics to previous cloud attack campaigns and emphasising the ongoing lure of misconfigured cloud services for threat actors.