Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Graboid: First-Ever Cryptojacking Worm Found in Images on Docker Hub

Summary: Unit 42 researchers identified a cryptojacking worm named Graboid that spread to more than 2,000 unsecured Docker hosts, the first time a cryptojacking worm has been seen spreading through containers in the Docker Engine Community Edition. The actor gained entry through unsecured Docker daemons, pulled malicious images such as pocosow/centos (over 10,000 downloads) and gakeaws/nginx (over 6,500 downloads) from Docker Hub, and deployed Monero miners that query command and control servers for new targets, with each miner active about 63% of the time in periods averaging 250 seconds.

What's compelling: A Shodan search found more than 2,000 Docker engines exposed to the internet without authentication, and a simulation showed the worm reaching 1,400 vulnerable hosts in about 60 minutes while sustaining roughly 900 active miners. The worm can pull new scripts from its 15 command and control servers, so the same foothold could be repurposed for ransomware rather than mining.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related