Cetus: Cryptojacking Worm Targeting Docker Daemons
Summary: Unit 42 researchers running a Docker daemon honeypot through May found a new cryptojacking worm, named Cetus, that scans random 16-bit subnets with Masscan for Docker daemons on port 2375 and infects them through the daemon's REST API using the Docker CLI. Cetus impersonates the legitimate Portainer binary, deploys an obfuscated XMRig 5.5.3 miner disguised as 'docker-cache' to mine Monero, and is linked to TeamTNT through a shared Monero wallet address.
What you should know: An unsecured Docker daemon exposed on port 2375 is enough for a worm to walk in, take over the host's CPU, and use it to find and infect the next daemon on the network - and this is the second Docker cryptojacking worm Unit 42 has documented after Graboid.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026