Threat actors have targeted internet-exposed Docker API endpoints with the advanced Commando Cat cryptojacking campaign since the beginning of the year, The Hacker News reports. Attacks commenced with the infiltration of vulnerable Docker instances, which were later exploited to facilitate the delivery of additional payloads and shell scripts before proceeding with credential exfiltration and the deployment of a Base64-encoded payload that delivers the XMRig cryptocurrency mining malware, according to a report from Cado Security Labs.

Source: SC Magazine