Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

20 Million Miners: Finding Malicious Cryptojacking Images in Docker Hub

Summary: Unit 42 researchers found 30 malicious cryptojacking images across 10 Docker Hub accounts, collectively pulled over 20 million times and estimated to have mined about US$200,000 worth of cryptocurrency. Most of the images mined Monero using XMRig, and some carried tags for different operating systems, CPU architectures and miner types, with a common wallet address or mining pool credential tying images to a campaign - including accounts 021982, dockerxmrig, ggcloud1 and ggcloud2 linked to the earlier azurenql campaign, adding over 10 million more pulls.

Bottom line: Twenty million pulls of images that exist only to mine crypto on someone else's bill, found with a scanner the researcher describes as detecting only simple payloads - the undiscovered remainder sits in the registry your build pipelines may pull from by default.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related