DERO Cryptojacking Exploits Anonymous Kubernetes APIs With Masqueraded Containers
Attack Surface Exposure · 2 sources · Updated 2mo ago · First seen May 16, 2024
An active cryptojacking campaign is targeting Internet-exposed Kubernetes API servers that permit anonymous authentication and grant excessive permissions. Attackers deploy malicious Docker Hub images impersonating legitimate Kubernetes components, abusing container deployment capabilities to run a UPX-packed DERO miner named pause; Kubernetes workloads can also enable deployment across multiple nodes and expand the attacker’s reach.
The miner stores encrypted, hardcoded wallet and mining-pool settings, avoiding conspicuous command-line arguments and configuration files. Supporting Linux tooling kills rival miners, selects GPU or CPU payloads, and modifies shell startup files for persistence. Defenders should remove public Kubernetes API exposure, disable or tightly restrict anonymous access, apply least-privilege RBAC, and permit only trusted, verified container images; Docker Hub removed the reported dockerproxys and nohuppo accounts.
