article thumbnail

Pro-Ukraine attackers compromise Docker images to launch DDoS attacks on Russian sites

Security Affairs

The attacks were monitored by cybersecurity firm CrowdStrike, who discovered that the Docker Engine honeypots deployed between February 27 and March 1 were compromised and used in the DDoS attacks. CrowdStrike Intelligence assesses these actors almost certainly compromised the honeypots to support pro-Ukrainian DDoS attacks.

Honeypots 108
article thumbnail

Free Tool: Honey Feed

Security Affairs

Cybersecurity expert Marco Ramilli shared another tool of his arsenal that extracts suspicious IPs from undesired connections, his HoneyPots. Hi folks, today I’d like to point you out another tool of mine which extracts suspicious IPs from undesired connections. In other words: HoneyPots. HoneyPot Page.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

Vulnerable Docker Installations Are A Playhouse for Malware Attacks

Security Affairs

Uptycs researchers identified ongoing malicious campaigns through our Docker honeypot targeting exposed Docker API. The Uptycs Threat Research team has identified ongoing malicious campaigns through our Docker honeypot targeting exposed Docker API port 2375. Figure 7:honeypot log – crypto miner attack. Figure 8: aaa.sh

article thumbnail

Cryptojacking campaign uses Shodan to scan for Docker hosts to hack

Security Affairs

“The script then calls a Monero coin-mining binary, darwin (detected as PUA.Linux.XMRMiner.AA), to run in the background. As with all cryptocurrency miners, it uses the resources of the host system to mine cryptocurrency (Monero in this instance) without the owner’s knowledge.” ” continues the report.

Mining 89
article thumbnail

Log4j Vulnerability Aftermath

Security Affairs

Using our threat intelligence systems and honeypot, the Uptycs threat research team identified different kinds of payloads dropped on the vulnerable servers. Xmrig is an open sourced Monero CPU Miner used to mine Monero cryptocurrency. Coinminers. Figure 1: Shell script downloading and executing Xmrig.

article thumbnail

Threat Group TeamTNT Returns with New Cloud Attacks

eSecurity Planet

However, the researchers are convinced the threat actor is back, as their honeypots identified TeamTNT signatures and tools in a series of three attacks during the first week of September. The attackers hijack the idle processing power of the targeted machines to mine cryptocurrency.

Cloud 136
article thumbnail

Experts spotted first-ever crypto mining campaign leveraging Kubernetes RBAC

Security Affairs

Experts warn of a large-scale cryptocurrency mining campaign exploiting Kubernetes (K8s) Role-Based Access Control ( RBAC ). Cloud security firm Aqua discovered a large-scale cryptocurrency mining campaign exploiting Kubernetes (K8s) Role-Based Access Control ( RBAC ) to create backdoors and run miners.

Mining 84