Xanthe - Docker aware miner
Summary: Cisco Talos reported a campaign against Linux systems using a multi-module botnet called Xanthe that spreads by harvesting client-side SSH certificates and by exploiting Docker daemons with exposed APIs on TCP port 2375. The payload is a variant of the XMRig Monero miner hidden by a libprocesshider shared object, while two bash scripts kill competing miners, add sudo users, and set cron jobs to re-download the modules every 30 minutes.
Key Takeaway: Shodan shows over 6,000 incorrectly configured Docker implementations exposed to the internet, and Xanthe's scangogo function scans local and external /24 subnets for exactly that port 2375 API to launch containers running its downloader.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026