{"id":56256,"date":"2024-06-06T00:00:00","date_gmt":"2024-06-06T00:00:00","guid":{"rendered":"urn:uuid:ee8e5fb5-d4bc-0efd-9341-0d39686c5415"},"modified":"2024-06-06T00:00:00","modified_gmt":"2024-06-06T00:00:00","slug":"commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/","title":{"rendered":"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/cc-cover:Large?qlt=80\"><!-- OneTrust Cookies Consent Notice start for trendmicro.com --><!-- OneTrust Cookies Consent Notice end for trendmicro.com --> <head> <meta charset=\"UTF-8\"> <meta name=\"viewport\" content=\"width=device-width\"> <meta name=\"description\" content=\"We analyze a cryptojacking attack campaign exploiting exposed Docker remote API servers to deploy cryptocurrency miners, using Docker images from the open-source Commando project.\"> <meta name=\"robots\" content=\"index,follow\"> <meta name=\"keywords\" content=\"cloud,malware,cyber crime,research,articles, news, reports,cyber threats,latest news\"> <meta http-equiv=\"X-UA-Compatible\" content=\"IE=edge,chrome=1\"> <meta name=\"template\" content=\"article1withouthero\"> <meta property=\"article:published_time\" content=\"2024-06-06\"> <meta property=\"article:tag\" content=\"cloud\"> <meta property=\"article:section\" content=\"research\"> <link rel=\"icon\" type=\"image\/ico\" href=\"\/content\/dam\/trendmicro\/favicon.ico\"> <link rel=\"canonical\" href=\"https:\/\/www.trendmicro.com\/en_us\/research\/24\/f\/commando-cat-a-novel-cryptojacking-attack-.html\"> <title>Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers | Trend Micro (US)<\/title> <link href=\"https:\/\/fonts.googleapis.com\/css?family=Open+Sans:300,300i,400,400i,600\" rel=\"stylesheet\">\n<link href=\"\/\/customer.cludo.com\/css\/296\/1798\/cludo-search.min.css\" type=\"text\/css\" rel=\"stylesheet\"> <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/trendresearch\/clientlibs\/clientlib-trendresearch.min.css\" type=\"text\/css\">\n<link rel=\"stylesheet\" href=\"\/etc.clientlibs\/trendmicro\/clientlibs\/trendmicro-core-2\/clientlibs\/header-footer.min.css\" type=\"text\/css\"> <meta property=\"og:url\" content=\"https:\/\/www.trendmicro.com\/en_us\/research\/24\/f\/commando-cat-a-novel-cryptojacking-attack-.html\"><br \/>\n<meta property=\"og:title\" content=\"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers\"><br \/>\n<meta property=\"og:description\" content=\"We analyze a cryptojacking attack campaign exploiting exposed Docker remote API servers to deploy cryptocurrency miners, using Docker images from the open-source Commando project.\"><br \/>\n<meta property=\"og:site_name\" content=\"Trend Micro\"><br \/>\n<meta property=\"og:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/24\/cc-cover.png\"><br \/>\n<meta property=\"og:locale\" content=\"en_US\"> <meta name=\"twitter:card\" content=\"summary_large_image\"><br \/>\n<meta name=\"twitter:site\" content=\"@TrendMicro\"><br \/>\n<meta name=\"twitter:title\" content=\"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers\"><br \/>\n<meta name=\"twitter:description\" content=\"We analyze a cryptojacking attack campaign exploiting exposed Docker remote API servers to deploy cryptocurrency miners, using Docker images from the open-source Commando project.\"><br \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/24\/cc-cover.png\"> <\/head> <body class=\"articlepage page basicpage context-business\" id=\"readabilityBody\" readability=\"49.725609756098\"> <!-- Page Scroll: Back to Top --> <a id=\"page-scroll\" title=\"VerticalPageScroll\" href=\"javascript:jumpScroll($(this).scrollTop());\"> <span class=\"icon-chevron-up\"><\/span> <\/a> <!-- \/* Data Layers *\/ --> <\/p>\n<div class=\"root responsivegrid\">\n<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12 \">\n<div class=\"articleBodyNoHero aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"research-layout article container\" role=\"contentinfo\">\n<article class=\"research-layout--wrapper row\" data-article-pageid=\"1412524221\">\n<div class=\"col-xs-12 col-md-12 one-column\">\n<div class=\"col-xs-12 col-md-12\" readability=\"8.771186440678\">\n<div class=\"article-details\" role=\"heading\" readability=\"37.033898305085\"> <span class=\"article-details__bar\" role=\"img\"><\/span> <\/p>\n<p class=\"article-details__display-tag\">Cloud<\/p>\n<p class=\"article-details__description\">We analyze a cryptojacking attack campaign exploiting exposed Docker remote API servers to deploy cryptocurrency miners, using Docker images from the open-source Commando project.<\/p>\n<p class=\"article-details__author-by\">By: Sunil Bharti, Shubham Singh <time class=\"article-details__date\">June 06, 2024<\/time> <span>Read time:&nbsp;<\/span><span class=\"eta\"><\/span> (<span class=\"words\"><\/span> words) <\/p>\n<div class=\"article-details__icons\"> <!--Add This--> <\/p>\n<div class=\"a2a_kit a2a_default_style\" data-a2a-icon-color=\"#717172\"> <a class=\"a2a_dd addthis_link\" href=\"https:\/\/www.addtoany.com\/share\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/etc.clientlibs\/trendresearch\/clientlibs\/clientlib-trendresearch\/resources\/img\/share-more.svg\" class=\"svg-icon\" alt=\"Share\"> <\/a> <a class=\"a2a_button_print addthis_link\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/etc.clientlibs\/trendresearch\/clientlibs\/clientlib-trendresearch\/resources\/img\/printer.svg\" class=\"svg-icon\" alt=\"Print\"> <\/a> <\/div>\n<p> <!--Add to Folio--> <!--Subscribe--> <\/div>\n<\/div><\/div>\n<\/p><\/div>\n<hr class=\"research-layout-divider\"> <main class=\"main--content col-xs-12 col-lg-8 col-lg-push-2\"> <\/p>\n<div class=\"richText\" readability=\"35.849884526559\">\n<div readability=\"19.811778290993\">\n<ul>\n<li><span class=\"rte-red-bullet\">We analyze a cryptojacking attack campaign exploiting exposed Docker remote API servers to deploy cryptocurrency miners, using Docker images from the open-source Commando project.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Malicious actors employ the <i>cmd.cat\/chattr<\/i> image for initial access, employing techniques like <i>chroot<\/i> and volume binding to break out of the container and access the host system.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Attack indicators can include specific User-Agent strings, plus the use of DropBear SSH on TCP port 3022, which can help in detecting the presence of the malware.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">To mitigate such attacks, it is essential to adhere to container security best practices, such as properly configuring containers and APIs and using trusted Docker images.<br \/>&nbsp;<\/span><\/li>\n<\/ul>\n<p>We observed an attack campaign abusing exposed <a href=\"https:\/\/docs.docker.com\/engine\/api\/v1.45\/\">Docker remote API<\/a> servers to deploy cryptocurrency miners. This attack campaign bears the name <a href=\"https:\/\/www.cadosecurity.com\/blog\/the-nine-lives-of-commando-cat-analysing-a-novel-malware-campaign-targeting-docker\">Commando Cat<\/a> due to its initial step, which involves the deployment of benign containers generated using the publicly-available <a href=\"https:\/\/github.com\/lukaszlach\/commando\">Commando project<\/a> (an open-source GitHub project that creates Docker images on-demand for developers). Commando, which is publicly available, is deployed using <a href=\"https:\/\/command-not-found.com\/\"><i>cmd.cat<\/i><\/a>. The attackers used the <u>cmd.cat\/chattr<\/u> docker image container that retrieves the payload from their own command-and-control (C&amp;C) infrastructure. This attack campaign has been active since the <a href=\"https:\/\/thehackernews.com\/2024\/02\/exposed-docker-apis-under-attack-in.html?trk=article-ssr-frontend-pulse_little-text-block\">start of 2024<\/a>.<\/p>\n<p>To gain initial access, the attacker deploys a docker image named <a href=\"https:\/\/command-not-found.com\/chattr\"><i>cmd.cat\/chattr<\/i><\/a>, a harmless docker image. Once deployed, the malicious actor creates a docker container based on this image and uses <a href=\"https:\/\/www.panoptica.app\/research\/7-ways-to-escape-a-container\">chroot to break out<\/a> of the container and gain access to the host operating system. It also uses <i>curl\/wget<\/i> to download the malicious binary into the host.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig1.jpg\" alt=\"Figure 1. Commando Cat attack sequence\"> <\/p>\n<div class=\"caption-image-container \"><figcaption>Figure 1. Commando Cat attack sequence<\/figcaption><\/div>\n<\/figure><\/div>\n<div>\n<div class=\"richText\" readability=\"34\">\n<div readability=\"13\">\n<p>Let&#8217;s break down how the attack unfolds step by step:<\/p>\n<p><b>1. Probing the Docker Remote API server<\/b><\/p>\n<p>The sequence of events in this attack campaign begins with a ping to the Docker Remote API server, which serves as the pivotal starting point for the ensuing chain of actions.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig2.jpg\" alt=\"Figure 2. Ping request to the Docker Remote API Server\"> <\/p>\n<div class=\"caption-image-container \"><figcaption>Figure 2. Ping request to the Docker Remote API Server<\/figcaption><\/div>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"32\">\n<div readability=\"9\">\n<p><b>2. Creating the container using the <i>cmd.cat\/chattr<\/i> image:<br \/><\/b>Upon confirming the server&#8217;s status as &#8220;OK,&#8221; the attacker proceeds to instantiate a container using the <i>cmd.cat\/chattr image<\/i>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <a class=\"bs-modal\" id=\"21d69d\" href=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig3.jpg\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig3.jpg\" alt=\"Figure 3. Container creation request to the Docker Remote API Server\"> <\/a> <\/p>\n<div class=\"caption-image-container \"><figcaption>Figure 3. Container creation request to the Docker Remote API Server<\/figcaption><\/div>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"39.5\">\n<div readability=\"24\">\n<p>In the container creation request, we see the malicious actor employing <i>chroot<\/i> and volume binding to escape the container. Using <i>chroot<\/i>, the attacker can peek outside the container and then enter the host system using the<i> Binds<\/i> parameter, which specifies volume bindings.<\/p>\n<p>The binding <i>\/:\/hs<\/i> mounts the host&#8217;s root directory into the container&#8217;s <i>\/hs<\/i> directory, granting the attacker unrestricted access to the host file system. It also binds the Docker socket (<i>\/var\/run\/docker.sock:\/var\/run\/docker.sock<\/i>), giving the container direct access to the Docker daemon on the host, therefore allowing the attackers to control Docker as if they were on the host machine itself.<\/p>\n<p><b>3. Image creation in absence<br \/><\/b>If the above request returns a \u201cNo such image\u201d response, the attacker will pull the <i>chattr<\/i> docker image from the <i>cmd.cat<\/i> repository.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig4.jpg\" alt=\"Figure 4. Chattr Docker image pull request\"> <\/p>\n<div class=\"caption-image-container \"><figcaption>Figure 4. Chattr Docker image pull request<\/figcaption><\/div>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"34\">\n<div readability=\"13\">\n<p><b>4. Container deployment<br \/><\/b>With the image in place, the attacker proceeds to create a Docker container, effectively executing a replica of the previous step.<\/p>\n<p>While creating the docker container, the malicious actor executes a base64-encoded string:<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <a class=\"bs-modal\" id=\"574a3c\" href=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig5.jpg\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig5.jpg\" alt=\"Figure 5. Base64-encoded payload string\"> <\/a> <\/p>\n<div class=\"caption-image-container \"><figcaption>Figure 5. Base64-encoded payload string<\/figcaption><\/div>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"31\">\n<div readability=\"7\">\n<p>This translates to the following shell script:<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig6.jpg\" alt=\"Figure 6. Base64-decoded shell script\"> <\/p>\n<div class=\"caption-image-container \"><figcaption>Figure 6. Base64-decoded shell script<\/figcaption><\/div>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"40.028947368421\">\n<div readability=\"26.360526315789\">\n<p>The script starts with a conditional check to determine if a file named &#8220;z&#8221; exists in the directory <i>\/usr\/sbin\/<\/i>. If the file does not exist, the script proceeds to download and execute the malicious binary from its file server (<i>hxxp[:]\/leetdbs[.]anondns[.]net\/z<\/i>) and saves it to the directory <i>\/usr\/sbin\/,<\/i> which is potentially <a href=\"https:\/\/github.com\/isdrupter\/ziggystartux\">ZiggyStarTux<\/a>, an open-source IRC bot based on the Kaiten malware. This binary is packed using the UPX packer.<\/p>\n<p>While doing the analysis, we found the C&amp;C server to be down. However, the following User-Agent strings present in the binary can be used to monitor the presence of this malware in the network:<\/p>\n<ul>\n<li><span class=\"rte-red-bullet\">User-Agent: HackZilla\/1.67 [en] (X11; U; Linux 2.2.16-3 x64)<\/span><\/li>\n<li><span class=\"rte-red-bullet\">User-Agent: Mozilla\/4.75 [en] (X11; U; Linux 2.2.16-3 i686)<\/span><\/li>\n<\/ul>\n<p>The strings present in this binary\/code suggest this malware is using <a href=\"https:\/\/matt.ucc.asn.au\/dropbear\/dropbear.html\">DropBear SSH<\/a>, a relatively small <a href=\"https:\/\/en.wikipedia.org\/wiki\/Secure_Shell\">SSH<\/a> server and client application on TCP port 3022. This could serve as another clue for spotting the malware.<\/p>\n<p>The deployed malware tries to connect its C&amp;C server 45[.]9[.]148[.]193 on port 1219. Figure 6 depicts the initial network traffic, which shows the initial IRC communication.&nbsp;<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/fig7.jpg\" alt=\"Figure 7. Initial IRC communication \"> <\/p>\n<div class=\"caption-image-container \"><figcaption>Figure 7. Initial IRC communication <\/figcaption><\/div>\n<\/figure><\/div>\n<div class=\"richText\" readability=\"41.281840884766\">\n<div readability=\"29.761327149483\">\n<p>The significance of this attack campaign lies in its use of Docker images to deploy cryptojacking scripts on compromised systems. This tactic allows attackers to exploit vulnerabilities in Docker configurations while evading detection by security software. As cybersecurity researchers continue to monitor this malicious actor, it&#8217;s essential for organizations to strengthen their defenses against Docker-related attacks.<\/p>\n<p>To protect development environments from attacks targeting containers and hosts, we recommend implementing the following best practices:<\/p>\n<ul>\n<li><span class=\"rte-red-bullet\">Containers and APIs should always be properly configured to minimize the chance of exploitative attacks. Docker has specific <a href=\"https:\/\/docs.docker.com\/develop\/dev-best-practices\/\">guidelines<\/a><u> <\/u>on how their users can strengthen their security.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Organizations should use only official or certified images to ensure that only trusted content is run within the environment.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Running containers should not be run with root privileges, but rather as application users instead.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Containers should be configured so that access is granted only to trusted sources, such as the internal network.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Organizations should adhere to recommended best practices. For example, Docker provides a comprehensive <a href=\"https:\/\/docs.docker.com\/engine\/security\/security\/\">list of best practices<\/a> and has built-in security features users can follow to improve the security of their cloud environments.<\/span><\/li>\n<li><span class=\"rte-red-bullet\">Security audits should be performed at regular intervals to check for any suspicious containers and images.\n<p>&nbsp;&nbsp;<\/p>\n<p><\/span><\/li>\n<li><span class=\"body-subhead-title\">Conclusion<\/span><\/li>\n<\/ul>\n<p>The Commando Cat attack campaign highlights the threat posed by the abuse of exposed Docker remote API servers. By exploiting Docker configurations and leveraging open-source tools like <i>cmd.cat<\/i>, attackers can gain initial access and deploy malicious binaries, while evading conventional security measures. The campaign&#8217;s use of Docker images to propagate cryptojacking scripts underscores the importance of implementing robust container security practices.<\/p>\n<p>The following security solutions are recommended for safeguarding Docker servers.<\/p>\n<p>The following protections exist to detect malicious activity and shield Trend customers from the attack discussed in this blog entry:<\/p>\n<ul>\n<li><span class=\"rte-red-bullet\">1010326 &#8211; Identified Docker Daemon Remote API Call<\/span><\/li>\n<li><span class=\"rte-red-bullet\">1008619 &#8211; Application \u2013 Docker<\/span><\/li>\n<li><span class=\"rte-red-bullet\">1010349 &#8211; Docker Daemon Remote API Calls<\/span><\/li>\n<\/ul>\n<h2><span class=\"body-subhead-title\">Trend Vision One hunting query<\/span><\/h2>\n<p>The following text lists potentially useful queries for threat hunting within Vision One:<\/p>\n<p><span class=\"blockquote\">eventId:100115 AND (remarks: POST_IMG_BLD_CRE OR remarks: POST_CON_CREATE) AND &#8220;cmd.cat&#8221;<\/span><\/p>\n<p><span class=\"body-subhead-title\">MITRE ATT&amp;CK<\/span><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"richText\">\n<div class=\"responsive-table-wrap\">\n<table cellpadding=\"1\" cellspacing=\"0\" border=\"1\" width=\"100%\" height=\"10%\">\n<tbody readability=\"3\">\n<tr>\n<th scope=\"col\"><b>Tactics<\/b><\/th>\n<th scope=\"col\"><b>Technique<\/b><\/th>\n<th scope=\"col\"><b>Technique ID<\/b><\/th>\n<\/tr>\n<tr readability=\"2\">\n<td rowspan=\"2\" height=\"46\" width=\"60\">Initial Access<\/td>\n<td rowspan=\"2\" width=\"64\">Exploit Public-Facing Application<\/td>\n<td rowspan=\"2\" width=\"64\">T1190<\/td>\n<\/tr>\n<tr><\/tr>\n<tr>\n<td rowspan=\"2\" height=\"46\" width=\"60\">Execution<\/td>\n<td width=\"64\">Deploy Container<\/td>\n<td width=\"64\">T1610<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td height=\"23\" width=\"64\">Command and Scripting Interpreter: Unix Shell<\/td>\n<td width=\"64\">T1059.004<\/td>\n<\/tr>\n<tr>\n<td height=\"23\" width=\"60\">Privilege Escalation<\/td>\n<td width=\"64\">Escape to Host<\/td>\n<td width=\"64\">T1611<\/td>\n<\/tr>\n<tr readability=\"2\">\n<td rowspan=\"2\" height=\"46\" width=\"60\">Command and Control<\/td>\n<td width=\"64\">Data Encoding: Standard Encoding<\/td>\n<td width=\"64\">T1132.001<\/td>\n<\/tr>\n<tr>\n<td height=\"23\" width=\"64\">Ingress Tool Transfer<\/td>\n<td width=\"64\">T1105<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/p><\/div>\n<div class=\"richText\" readability=\"29.574712643678\">\n<div readability=\"6.6781609195402\">\n<p><span class=\"body-subhead-title\">Indicators of Compromise<\/span><\/p>\n<p>The indicators of compromise for this entry can be found <a href=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/24\/f\/commando-cat\/ioc-commando-cat.txt\">here<\/a>.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<section class=\"tag--list\">\n<p>Tags<\/p>\n<\/section>\n<p> <\/main> <\/article>\n<\/div>\n<\/div><\/div>\n<\/div>\n<p> <!-- \/* Core functionality javascripts, absolute URL to leverage Akamai CDN *\/ --> <!--For Modal-start--> <\/p>\n<p> <span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk<\/span> <\/p>\n<p> <!--For Modal-end--> <\/body> Read More <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/24\/f\/commando-cat-a-novel-cryptojacking-attack-.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>We analyze a cryptojacking attack campaign exploiting exposed Docker remote API servers to deploy cryptocurrency miners, using Docker images from the open-source Commando project. Read More HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9510,9520,9521,9511,9513,9509],"class_list":["post-56256","post","type-post","status-publish","format-standard","hentry","category-trendmicro","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-cloud","tag-trend-micro-research-cyber-crime","tag-trend-micro-research-cyber-threats","tag-trend-micro-research-malware","tag-trend-micro-research-research"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2024-06-06T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/cc-cover:Large?qlt=80\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers\",\"datePublished\":\"2024-06-06T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/\"},\"wordCount\":1224,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/cc-cover:Large?qlt=80\",\"keywords\":[\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Cloud\",\"Trend Micro Research : Cyber Crime\",\"Trend Micro Research : Cyber Threats\",\"Trend Micro Research : Malware\",\"Trend Micro Research : Research\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/\",\"name\":\"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/cc-cover:Large?qlt=80\",\"datePublished\":\"2024-06-06T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/#primaryimage\",\"url\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/cc-cover:Large?qlt=80\",\"contentUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/cc-cover:Large?qlt=80\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : Articles, News, Reports\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-articles-news-reports\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/","og_locale":"en_US","og_type":"article","og_title":"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2024-06-06T00:00:00+00:00","og_image":[{"url":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/cc-cover:Large?qlt=80","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers","datePublished":"2024-06-06T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/"},"wordCount":1224,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/cc-cover:Large?qlt=80","keywords":["Trend Micro Research : Articles, News, Reports","Trend Micro Research : Cloud","Trend Micro Research : Cyber Crime","Trend Micro Research : Cyber Threats","Trend Micro Research : Malware","Trend Micro Research : Research"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/","url":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/","name":"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/#primaryimage"},"thumbnailUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/cc-cover:Large?qlt=80","datePublished":"2024-06-06T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/#primaryimage","url":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/cc-cover:Large?qlt=80","contentUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/cc-cover:Large?qlt=80"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/commando-cat-a-novel-cryptojacking-attack-abusing-docker-remote-api-servers\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : Articles, News, Reports","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-articles-news-reports\/"},{"@type":"ListItem","position":3,"name":"Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56256","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=56256"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/56256\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=56256"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=56256"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=56256"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}