9/8/25, 4:31 PM

Darktrace’s Inside the SOC blog published on 18 January 2024 describes a campaign targeting vulnerable Docker services, observed by Cado Security Labs researchers (now part of Darktrace). According to Cado Security Labs, attackers deploy two containers to the vulnerable host—the regular XMRig miner and the 9hits viewer application—with the 9hits platform used to generate credits by visiting websites requested by others.

The spreader uses the Docker API to deploy images from minerboy/XMRig and 9hitste/app, and network evidence from the honeypot shows a docker client user agent, suggesting a script was used to imitate a Docker CLI and compromise the server. The payload includes a session token (c89f8b41d4972209ec497349cce7e840) added to an nh[.]sh script to authenticate with attacker servers and pull a list of sites to visit, with 9hits designed to run headless Chrome to generate traffic.

The main impact on infected hosts is resource exhaustion from the XMRig miner and heavy bandwidth use by 9hits, which can degrade legitimate workloads and potentially leave a remote shell if updated.