A hacking group is hijacking Docker systems with exposed API endpoints

guest · Nov 25, 2019

A hacking group is hijacking Docker systems with exposed API endpoints
November 26, 2019
https://www.zdnet.com/article/a-hac...ng-docker-systems-with-exposed-api-endpoints/

A hacking group is currently mass-scanning the internet looking for Docker platforms that have API endpoints exposed online.
The purpose of these scans is to allow the hacker group to send commands to the Docker instance and deploy a cryptocurrency miner on a company's Docker instances, to generate funds for the group's own profits.
A PROFESSIONAL OPERATION
This particular mass-scanning operation started over the weekend, on November 24, and immediately stood out due to its sheer size.

"Users of the Bad Packets CTI API will note that exploit activity targeting exposed Docker instances is nothing new and happens quite often," Troy Mursch, chief research officer and co-founder of Bad Packets LLC, told ZDNet today.
"As others have noted [1, 2], this isn't your average script kiddie exploit attempt," Mursch, who discovered the campaign, told us.

For the time being, Mursch recommends that users and organizations who run Docker instances immediately check if they are exposing API endpoints on the internet, close the ports, and then terminate unrecognized running containers.
Click to expand...

Log in or Sign up

A hacking group is hijacking Docker systems with exposed API endpoints

guest Guest

Log in or Sign up

A hacking group is hijacking Docker systems with exposed API endpoints

guest Guest

Useful Searches