Loading story…
Threat actors were observed targeting exposed Docker APIs by deploying a malicious container image named gin with the --privileged option, then abusing the Linux cgroups release_agent mechanism to escape the container and execute code on the host. Trend Micro detected the activity in a honeypot after the environment was identified by the zgrab scanner, showing how internet-exposed container management interfaces can be rapidly discovered and exploited.
The attack chain used a script called calm.sh, which dropped another script named cmd and launched a fake nginx binary that was actually an ELF cryptocurrency miner. If the container escape attempt failed, the attackers still tried to mine cryptocurrency directly on the vulnerable server, underscoring that misconfigured privileged containers can turn a Docker deployment into a host-level compromise and that image security requires more than basic vulnerability scanning alone.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
In October 2021, Trend Micro observed attackers abusing exposed Docker REST APIs to deploy malicious containers that scanned for more exposed Docker services, escaped to hosts, installed Monero miners, and added TeamTNT SSH access. Trend Micro linked the activity to TeamTNT through infrastructure, tooling, SSH key usage, and Docker Hub accounts such as 'alpineos,' and said Docker removed the identified malicious accounts.
Felix Wilhelm of Google's Security Team published a proof of concept showing how a privileged Docker container or Kubernetes pod could escape to the host by abusing the cgroups release_agent feature. This technique later matched the method used in the observed attack.
Trend Micro observed an attack against its honeypot after an exposed Docker API was discovered by the zgrab scanner. The attacker pulled a malicious container image named "gin," ran it with the privileged option enabled, and used scripts including calm.sh to attempt host escape and deploy a disguised cryptocurrency miner.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors abused exposed Docker servers by creating a malicious Alpine Linux container that launched a multi-stage infection chain, ultimately installing both a cryptocurrency miner and an IRC-based DDoS bot. The attack used a Bash script named `XMI` and a Python script named `d.py` to download payloads, establish persistence, and spread further, with the miner identified as **Coinminer.Linux.MALXMR.UWELD** and the bot as a Kaiten/Tsunami variant detected as **Backdoor.Linux.KAITEN.AMV**. The malware relied on Base64 obfuscation, cron jobs, and a service placed in `/etc/init.d` for persistence, and it attempted lateral movement by harvesting targets from `/.ssh/known_hosts`; researchers also found commented-out SSH brute-force propagation code. Trend Micro said the miner wallet overlapped with earlier campaigns exploiting `CVE-2019-3396` and `CVE-2017-5638`, previously associated in public reporting with the **8220** mining group, while the DDoS component communicated with command-and-control infrastructure including `c4k[.]xpl[.]pwndns[.]pw`, `104[.]244[.]75[.]25`, and `107[.]189[.]11[.]170`.
Aug 14, 2026
Palo Alto Networks Unit 42 reported that attackers are actively targeting **unsecured Docker daemons** exposed to the internet, using the Docker API to create and run malicious containers on victim systems. By abusing misconfigured deployments that lack proper access controls, intruders can gain effective control of the underlying host, execute arbitrary workloads, and use compromised infrastructure for follow-on activity such as cryptomining, persistence, and broader cloud or network compromise. The report details attacker tradecraft focused on exposed container management interfaces, where adversaries issue Docker commands remotely to pull attacker-controlled images and launch privileged containers that can interact with the host environment. The activity highlights a recurring cloud security risk: organizations that leave Docker services reachable without authentication can enable rapid compromise of containerized environments and the systems that support them.
Jul 12, 2026
Attackers abused misconfigured Docker Engine instances that exposed the unauthenticated Docker API on port `2375`, using it to enumerate running containers and execute malware inside them. Trend Micro reported that the campaign leveraged `docker exec` to deploy an AESDDoS payload detected as **Backdoor.Linux.DOFLOO.AA**, giving operators the ability to run distributed denial-of-service attacks from compromised container environments. The activity relied on scanning IP ranges for hosts with port `2375` open and using a toolkit distributed in a ZIP archive named `2375-SYNG口漏洞.zip`, which included utilities such as **WinEggDrop** and a **Docker Batch Test Tool** to find and exploit vulnerable systems. Researchers warned that exposing the Docker daemon in this way can effectively grant root-level control of the host, and noted that the AESDDoS variant has also been linked to remote code execution and cryptocurrency-mining activity.
Aug 14, 2026