Attackers Cryptojacking Docker Images to Mine for Monero
Summary: Unit 42 identified a Docker Hub account named azurenql, active since October 2019, hosting six malicious images built to mine Monero, with the top image pulled more than 1.47 million times and the account's images collectively pulled over two million times. The images bundle Tor and ProxyChains-NG to route mining traffic through a local SOCKS proxy, and a custom Python script, dao.py, set as the image Entrypoint, launches XMRig against either the minexmr.com pool or attacker-hosted mining infrastructure.
Bottom line: One wallet ID tied to this campaign earned 525.38 XMR, roughly $36,000, and was still active when Unit 42 last checked minexmr.com - meaning compute pulled from a public registry converted directly into revenue while defenders saw only anonymized traffic.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026