Loading story…
Threat actors abused exposed Docker servers by creating a malicious Alpine Linux container that launched a multi-stage infection chain, ultimately installing both a cryptocurrency miner and an IRC-based DDoS bot. The attack used a Bash script named XMI and a Python script named d.py to download payloads, establish persistence, and spread further, with the miner identified as Coinminer.Linux.MALXMR.UWELD and the bot as a Kaiten/Tsunami variant detected as Backdoor.Linux.KAITEN.AMV.
The malware relied on Base64 obfuscation, cron jobs, and a service placed in /etc/init.d for persistence, and it attempted lateral movement by harvesting targets from /.ssh/known_hosts; researchers also found commented-out SSH brute-force propagation code. Trend Micro said the miner wallet overlapped with earlier campaigns exploiting CVE-2019-3396 and CVE-2017-5638, previously associated in public reporting with the 8220 mining group, while the DDoS component communicated with command-and-control infrastructure including c4k[.]xpl[.]pwndns[.]pw, 104[.]244[.]75[.]25, and 107[.]189[.]11[.]170.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The report states that an earlier Docker-focused attack had been reported in May and likewise used a malicious Alpine Linux container to host both a cryptocurrency miner and a DDoS bot.
Trend Micro reported an attack in which threat actors connected to exposed Docker servers, created a malicious Alpine Linux container, and deployed both a coinminer and an IRC-based Kaiten/Tsunami DDoS bot. The infection chain used XMI and d.py scripts for persistence, lateral movement, and payload delivery.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused misconfigured Docker Engine instances that exposed the unauthenticated Docker API on port `2375`, using it to enumerate running containers and execute malware inside them. Trend Micro reported that the campaign leveraged `docker exec` to deploy an AESDDoS payload detected as **Backdoor.Linux.DOFLOO.AA**, giving operators the ability to run distributed denial-of-service attacks from compromised container environments. The activity relied on scanning IP ranges for hosts with port `2375` open and using a toolkit distributed in a ZIP archive named `2375-SYNG口漏洞.zip`, which included utilities such as **WinEggDrop** and a **Docker Batch Test Tool** to find and exploit vulnerable systems. Researchers warned that exposing the Docker daemon in this way can effectively grant root-level control of the host, and noted that the AESDDoS variant has also been linked to remote code execution and cryptocurrency-mining activity.
Aug 14, 2026
AhnLab Security intelligence Center (ASEC) reported an ongoing campaign targeting poorly managed Linux servers, where attackers gain access through SSH brute-force attempts or stolen credentials and then deploy propagation malware to install **XMRig**-based coin miners. Observed through multiple honeypots, the activity uses a multi-stage toolset that includes Go-based downloaders and SSH spreaders, along with malware families such as **ShellBot/PerlBot**, **MIG LogCleaner**, and **XHide** to move laterally, fetch payloads, hide activity, and maintain control of compromised hosts. The miners are disguised as legitimate processes and are installed with multiple persistence mechanisms, including `systemd` services, cron jobs, hidden binary paths, and watchdog functions that restore deleted payloads. ASEC said the propagation malware scans for exposed SSH services, authenticates with credential lists, installs miners on newly compromised systems, and reports results back to attacker infrastructure, assessing that the same threat actor has likely been conducting Linux-focused cryptomining attacks since at least 2023.
Jul 15, 2026
Cisco Talos reported a previously unreported Linux botnet dubbed **Xanthe** that targets internet-exposed systems for **Monero** mining, including hosts reachable through SSH and exposed Docker APIs on TCP port `2375`. The malware is modular and deploys **XMRig**, spreading primarily by harvesting client-side SSH keys and known-host data, while also abusing misconfigured Docker environments to gain execution on containerized infrastructure. Once installed, Xanthe uses multiple defense-evasion and persistence techniques to retain control and maximize mining time. Talos said the malware deploys a `libprocesshider` shared object to conceal miner activity, disables security tools, removes competing miners, weakens SSH settings, creates privileged users, installs attacker SSH keys, modifies firewall rules, and persists through cron jobs and `rc.local` changes—behavior consistent with the **Impair Defenses** technique tracked in MITRE ATT&CK as `T1562.001`.
Aug 14, 2026