Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Docker Honeypot Reveals Cryptojacking as Most Common Cloud Threat

Summary: Unit 42 deployed a honeypot mimicking a misconfigured Docker daemon and recorded 850 attacks of 33 different types between March and April 2021, roughly one every 90 minutes over 50 days. More than 75% were cryptojacking, Kinsing was the most common malware with 360 attacks, and TeamTNT operated three of the five most common attacks, including two new botnet variants that steal AWS credentials and scan for vulnerable Docker instances.

Why it matters: A Docker daemon exposed on a TCP socket has no authentication or authorization by default, so anyone who reaches it gets full privileges - and Unit 42 previously found 1,400 vulnerable Docker instances on the web, a population TeamTNT's new variant actively scans for and reports to a C2 server.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related