'Commando Cat' Cryptojacking Campaign Targets Exposed Docker APIs

A sophisticated cryptojacking operation named Commando Cat is exploiting internet-exposed Docker API endpoints, according to security researchers Nate Bill and Matt Muir from Cado Security.

Active since early 2024, Commando Cat utilizes Docker for initial access, deploying a seemingly harmless container created with the Commando open-source project. The attackers then break out of this container to execute various malicious activities on the Docker host.

This campaign marks the second major Docker-targeted attack revealed within a few months. Previously, Cado Security uncovered an operation deploying the XMRig cryptocurrency miner and the 9Hits Viewer software on vulnerable Docker hosts.

Key aspects of the Commando Cat campaign include:

1. Using Docker for Initial Access: The campaign starts by compromising Docker instances to deliver multiple interlinked payloads from a server controlled by the attackers. These payloads are designed for persistence, host backdooring, credential theft for cloud service providers, and initiating a cryptocurrency mining process.

2. Container Escape and Payload Execution: The attackers deploy a benign container via Commando and execute a command allowing them to escape the container using the chroot command.

3. System Checks: The malware performs checks to identify if certain services (like "sys-kernel-debugger," "gsc," "c3pool_miner," and "dockercache") are running on the compromised system. It proceeds to the next stage only if these checks are passed. The presence of the "sys-kernel-debugger" service is particularly notable as its purpose in the malware is unclear, suggesting it might be related to another campaign.

4. Additional Payload Deployment: After passing the checks, the campaign retrieves more payloads from the command-and-control server. This includes a shell script backdoor (user.sh) capable of adding an SSH key to the ~/.ssh/authorized_keys file. It also creates a new user named "games" with a known password to the attackers and adds it to the /etc/sudoers file for escalated privileges.

The Commando Cat campaign highlights the ongoing risks of exposed Docker instances and the sophisticated methods attackers use to exploit such vulnerabilities for cryptojacking and other malicious purposes.