{"id":36319,"date":"2020-07-28T12:43:00","date_gmt":"2020-07-28T12:43:00","guid":{"rendered":"http:\/\/ede39ef7-6502-4d67-9cf4-02960e818aaa"},"modified":"2020-07-28T12:43:00","modified_gmt":"2020-07-28T12:43:00","slug":"new-linux-malware-uses-dogecoin-api-to-find-cc-server-addresses","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/new-linux-malware-uses-dogecoin-api-to-find-cc-server-addresses\/","title":{"rendered":"New Linux malware uses Dogecoin API to find C&C server addresses"},"content":{"rendered":"
\"Dogecoin<\/span>
<\/span><\/figcaption><\/figure>\n

While Linux malware was once sitting on the fringes of the malware ecosystem, today, new Linux threats are being discovered on a weekly basis.<\/p>\n

The latest finding comes from Intezer Labs. In a report<\/a> shared with ZDNet this week, the company analyzed Doki, a new backdoor trojan they spotted part of the arsenal of an old threat actor known for targeting web servers for crypto-mining purposes.<\/p>\n

The threat actor, known as Ngrok<\/a> because of its initial penchant for using the Ngrok service for hosting control and command (C&C) servers, has been active since at least late 2018.<\/p>\n

Intezer Labs researchers say that in recent attacks carried out by the Ngrok group this year, the hackers have targeted Docker installations where the management API has been left exposed online.<\/p>\n

The hackers abused the Docker API to deploy new servers inside a company’s cloud infrastructure. The servers, running a version of Alpine Linux, were then infected with crypto-mining malware, but also Doki.<\/p>\n

\"doki-ngrok.png\"<\/span>