• Exploit Public-Facing Application
• Network Service Discovery
• Web Protocols
• Business Services
• Unix Shell
• Resource Hijacking
• Smb/Windows Admin Shares
• External Remote Services
• United States
• Ingress Tool Transfer
• Obfuscated Files Or Information
• Deploy Container
• Match Legitimate Name Or Location
• Escape To Host
• Change Default File Association
• North America
• Docker
• Exploitation For Client Execution
• Remote System Discovery
• Lateral Tool Transfer

Cryptojacking Campaign Targets Misconfigured Docker APIs

A new malware campaign has emerged, targeting misconfigured Docker API instances to create a cryptocurrency mining botnet focused on mining Dero currency. The threat actor exploits insecurely published Docker APIs to gain access to running containerized infrastructures, propagating the malware through a worm-like mechanism to infect other exposed Docker instances. The attack utilizes two main components: a propagation malware named 'nginx' that scans for vulnerable Docker APIs, and a 'cloud' Dero cryptocurrency miner. This campaign has been linked to previous cryptojacking operations and poses a significant risk to any network with insecure Docker APIs.

• Eastern Europe
• Financial Theft
• Cameleon
• Resource Hijacking
• Europe
• Business Services
• Bitdefender
• Venom Rat
• Romania

New Malicious Campaign Exploits Fake Antivirus Website to Distribute Venom RAT

Cybersecurity researchers have uncovered a malicious campaign that utilizes a fraudulent website masquerading as Bitdefender's antivirus software to distribute a remote access trojan known as Venom RAT. The site, bitdefender-download[.]com, tricks users into downloading a zip file containing malware disguised as an installer. This campaign aims to compromise victims' credentials and crypto wallets, highlighting a trend of sophisticated, modular malware that leverages open-source components for more effective attacks.