December 3, 2024 at 01:48PM Trend Micro Research reports a shift in Gafgyt malware targeting misconfigured Docker Remote API servers, previously focusing on IoT devices. Attackers deploy malware via Docker containers, enabling DDoS attacks. Recommendations for securing servers include strong access controls, regular monitoring, and educating personnel on best practices. ### Meeting Takeaways **Key Report … Read more
December 3, 2024 at 04:49AM Trend Micro Research reports that Gafgyt malware is now targeting misconfigured Docker Remote API servers, a shift from its traditional focus on IoT devices. This allows attackers to deploy DDoS attacks. Recommendations include strengthening access controls, monitoring activities, and ensuring adherence to container security best practices. ### Meeting Takeaways on … Read more
October 26, 2024 at 05:12AM TeamTNT, a notable cryptojacking group, is launching a large-scale campaign targeting cloud environments to mine cryptocurrencies using compromised Docker daemons and servers. They deploy Sliver malware, offer breached computational power for rent, and have shifted tactics, indicating an evolving and mature illicit business model in the cybercrime landscape. ### Meeting … Read more
October 23, 2024 at 10:36PM Trend Micro researchers report that attackers are exploiting exposed Docker Remote API servers to deploy perfctl cryptomining malware. These vulnerabilities allow unauthorized access and control over Linux servers. To mitigate risks, organizations should implement strong access controls, monitor for suspicious activities, and adhere to container security best practices. ### Meeting … Read more
October 22, 2024 at 10:30AM Trend Micro reports attacks on Docker remote API servers, deploying SRBMiner to mine XRP cryptocurrency. Attackers use the gRPC protocol over h2c to bypass security measures. They probe for public Docker APIs, upgrade connections, and execute malicious commands. Users are advised to enhance security measures to prevent unauthorized access. **Meeting … Read more
October 22, 2024 at 05:46AM Trend Micro researchers report a cyberattack targeting Docker remote API servers to deploy the SRBMiner cryptominer for mining XRP cryptocurrency. The attacker exploited the gRPC protocol over h2c to bypass security measures, checked Docker API availability, and deployed the miner, emphasizing the need for improved security configurations in Docker environments. … Read more
October 21, 2024 at 11:30AM Attacks on exposed Docker Remote API servers deploy the perfctl malware through probing and payload execution. Attackers create containers, execute Base64 encoded payloads, and use evasion tactics to avoid detection. Recommendations to enhance security include strong access controls, regular monitoring, and adherence to container security best practices. ### Meeting Takeaways … Read more
June 24, 2024 at 04:43PM A critical vulnerability, dubbed Probllama (CVE-2024-37032), in the Ollama project for running LLMs allows remote code execution. The flaw, fixed in version 0.1.34, impacts over 1,000 exposed instances. Wiz Research urges timely updating and implementing strong authentication measures, emphasizing the risk associated with unpatched instances. This underscores the need for … Read more
June 18, 2024 at 06:19AM Cybersecurity researchers have discovered a new malware campaign targeting exposed Docket API endpoints, deploying cryptocurrency miners and accessing more malicious programs via a remote access tool. The attack involves reconnaissance, privilege escalation, and exploitation of Docker servers. The campaign is linked to a previous activity dubbed Spinning YARN and features … Read more
June 7, 2024 at 01:48AM Commando Cat, a threat actor, is behind a cryptojacking campaign leveraging poorly secured Docker instances to deploy cryptocurrency miners. The attacks involve targeting misconfigured Docker remote API servers and using Docker images to deploy cryptojacking scripts, evading detection by security software. Additionally, Chinese-speaking threat actors exploit ThinkPHP applications to deliver … Read more