Hackers Mass-Scanning Web for Docker Platforms to Mine Cryptocurrencies

A group of hackers has launched a new cryptojacking campaign on Nov. 24, scanning as many as 59,000 IP networks to find Docker platforms that have API endpoints exposed online, business technology publication ZDNet reports Nov. 26.

According to the report, the campaign is targeting vulnerable Docker instances in order to deploy crypto-malware to generate funds for the hacking group by mining Monero (XMR).

The mass scanning issue was first discovered by American internet security firm Bad Packets LLC on Nov. 25.

Troy Mursch, chief research officer and co-founder of Bad Packets LLC, said that exploit activity targeting exposed Docker instances is not new and happens quite often. In March 2018, cybersecurity company Imperva reported that 400 Docker servers — which were remotely accessible through an API weakness — contained Monerno mining programs.

Hackers used a “classic” XMR crypto miner

Mursch, who reportedly discovered the campaign, told ZDNet that once the hacking group…