Tag: docker
-
âš¡ Weekly Recap: NFC Fraud, Curly COMrades, N-able Exploits, Docker Backdoors & More
Power doesn’t just disappear in one big breach. It slips away in the small stuff”, a patch that’s missed, a setting that’s wrong, a system no one is watching. Security usually doesn’t fail all at once; it breaks slowly, then suddenly. Staying safe isn’t about knowing everything”, it’s about acting fast and clear before problems…
-
Whispers of XZ Utils Backdoor Live on in Old Docker Images
Developers maintaining the images made the intentional choice to leave the artifacts available as a historical curiosity, given the improbability they’d be exploited. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/xz-utils-backdoor-live-old-docker-images
-
Docker Hub still hosts dozens of Linux images with the XZ backdoor
The XZ-Utils backdoor, first discovered in March 2024, is still present in at least 35 Linux images on Docker Hub, potentially putting users, organizations, and their data at risk. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/docker-hub-still-hosts-dozens-of-linux-images-with-the-xz-backdoor/
-
Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks
New research has uncovered Docker images on Docker Hub that contain the infamous XZ Utils backdoor, more than a year after the discovery of the incident.More troubling is the fact that other images have been built on top of these infected base images, effectively propagating the infection further in a transitive manner, Binarly REsearch said…
-
CISA releases Thorium, an open-source, scalable platform for malware analysis
Tags: access, ceo, cio, cisa, compliance, container, control, cyber, cybersecurity, data, docker, framework, github, governance, incident response, kubernetes, malware, open-source, privacy, risk, skills, toolRethinking malware analysis at scale: Enterprise-grade malware analysis tools and platforms have been widely used in the security community. But many of them require paid licenses, lack orchestration at scale, or are difficult to integrate with enterprise workflows. Experts view Thorium as a significant democratization of advanced malware analysis technology.”It is a big deal as…
-
Google patches Gemini CLI tool after prompt injection flaw uncovered
README.md GNU Public License file of the sort that would be part of any open source repo.The researchers then uncovered a combination of smaller weaknesses that could be exploited together to run malicious shell commands without the user’s knowledge. The first weakness is that Gemini CLI sensibly allows users to allowlist frequent commands, for example,…
-
Threat Actor Mimo Targets Magento and Docker to Deploy Crypto Miners and Proxyware
The threat actor behind the exploitation of vulnerable Craft Content Management System (CMS) instances has shifted its tactics to target Magento CMS and misconfigured Docker instances.The activity has been attributed to a threat actor tracked as Mimo (aka Hezb), which has a long history of leveraging N-day security flaws in various web applications to deploy…
-
Behind the code: How developers work in 2025
How are developers working in 2025? Docker surveyed over 4,500 people to find out, and the answers are a mix of progress and ongoing pain points. AI is gaining ground but … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/07/11/docker-2025-developer-trends/
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 51
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Ransomware Gangs Collapse as Qilin Seizes Control Dissecting a Python Ransomware distributed through GitHub repositories SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play Uncovering a Tor-Enabled Docker Exploit…
-
University Student Charged for Alleged Hacking and Data Theft
A 27-year-old former student of Western Sydney University has been charged with a string of cyber offences, following an extensive investigation into a series of cyber attacks that have plagued the institution since 2021. The arrest comes after a coordinated operation by the NSW Police Cybercrime Squad under Strike Force Docker, working in partnership with…
-
Unsecured Docker APIs tapped for clandestine cryptomining
First seen on scworld.com Jump to article: www.scworld.com/brief/unsecured-docker-apis-tapped-for-clandestine-cryptomining
-
Hackers Exploit Misconfigured Docker APIs to Mine Cryptocurrency via Tor Network
Misconfigured Docker instances are the target of a campaign that employs the Tor anonymity network to stealthily mine cryptocurrency in susceptible environments.”Attackers are exploiting misconfigured Docker APIs to gain access to containerized environments, then using Tor to mask their activities while deploying crypto miners,” Trend Micro researchers Sunil Bharti and Shubham Singh said in an…
-
Attackers Use Docker APIs, Tor Anonymity in Stealthy Crypto Heist
The attack is similar to previous campaigns by an actor called Commando Cat to use misconfigured APIs to compromise containers and deploy cryptocurrency miners. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/attackers-docker-apis-tor-anonymity-crypto-heist
-
New quantum system offers publicly verifiable randomness for secure communications
Tags: blockchain, communications, crypto, cyber, cybersecurity, docker, email, finance, government, Hardware, infrastructure, open-source, software, technology, threat, toolNature and detailed in an accompanying arXiv preprint, CURBy leverages the phenomenon of quantum entanglement, where particles maintain interconnected states regardless of distance, to create fundamentally unpredictable outputs.”From a security perspective, this approach offers something valuable the ability to independently verify that random numbers haven’t been compromised,” noted Narayan Gokhale, vice president at QKS Group.…
-
Docker, HashiCorp, Gitea servers targeted in cryptojacking campaign
Tags: dockerFirst seen on scworld.com Jump to article: www.scworld.com/news/docker-hashicorp-gitea-servers-targeted-in-cryptojacking-campaign
-
Illicit crypto-miners pouncing on lazy DevOps configs that leave clouds vulnerable
To stop the JINX-0132 gang behind these attacks, pay attention to HashiCorp, Docker, and Gitea security settings First seen on theregister.com Jump to article: www.theregister.com/2025/06/03/illicit_miners_hashicorp_tools/
-
Cryptojacking campaign relies on DevOps tools
A cryptojacking campaign is targeting exposed DevOps servers like Docker and Gitea to secretly mine cryptocurrency. Wiz researchers uncovered a cryptojacking campaign, tracked as JINX-0132, targeting exposed DevOps applications like Nomad, Consul, Docker, Gitea to secretly mine cryptocurrency. Threat actors behind the campaign are exploiting a wide range of known misconfigurations and vulnerabilities to deliver the miner.…
-
Cryptojacking Campaign Exploits DevOps APIs Using OffShelf Tools from GitHub
Cybersecurity researchers have discovered a new cryptojacking campaign that’s targeting publicly accessible DevOps web servers such as those associated with Docker, Gitea, and HashiCorp Consul and Nomad to illicitly mine cryptocurrencies.Cloud security firm Wiz, which is tracking the activity under the name JINX-0132, said the attackers are exploiting a wide range of known misconfigurations and…
-
New Self-Spreading Malware Infects Docker Containers to Mine Dero Cryptocurrency
Misconfigured Docker API instances have become the target of a new malware campaign that transforms them into a cryptocurrency mining botnet.The attacks, designed to mine for Dero currency, is notable for its worm-like capabilities to propagate the malware to other exposed Docker instances and rope them into an ever-growing horde of mining bots.Kaspersky said it…
-
Neue Malware-Kampagne zielt auf offene Docker-Umgebungen
Eine neu entdeckte Cyberkampagne nutzt schwach gesicherte Docker-APIs als Einfallstor in containerisierte Infrastrukturen. Mit raffiniert getarnten Malware-Komponenten übernehmen die Angreifer Containerumgebungen, schürfen Kryptowährungen und nutzen kompromittierte Systeme als Sprungbrett für weitere Attacken. Die potenzielle Ausbreitung ist enorm. First seen on itsicherheit-online.com Jump to article: www.itsicherheit-online.com/news/cybersecurity/neue-malware-kampagne-zielt-auf-offene-docker-umgebungen/
-
Critical Versa Concerto Flaws Let Attackers Escape Docker and Compromise Hosts
Cybersecurity researchers have uncovered multiple critical security vulnerabilities impacting the Versa Concerto network security and SD-WAN orchestration platform that could be exploited to take control of susceptible instances.It’s worth noting that the identified shortcomings remain unpatched despite responsible disclosure on February 13, 2025, prompting a public release of the issues First seen on thehackernews.com Jump…
-
Getarnte Krypto-Miner kapern Docker-Container
Eine neue, raffiniert angelegte Cyberkampagne nutzt Schwachstellen in öffentlich erreichbaren Docker-APIs aus. Ziel ist es, Container-Umgebungen mit Krypto-Mining-Malware zu infizieren und das mit hohem Automatisierungsgrad. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/krypto-miner-docker
-
Unpatched Versa Concerto Flaws Let Attackers Escape Docker and Compromise Host
Cybersecurity researchers have uncovered multiple critical security vulnerabilities impacting the Versa Concerto network security and SD-WAN orchestration platform that could be exploited to take control of susceptible instances.It’s worth noting that the identified shortcomings remain unpatched despite responsible disclosure on February 13, 2025, prompting a public release of the issues First seen on thehackernews.com Jump…
-
Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication
Tags: api, attack, container, crypto, cyber, cybersecurity, data-breach, docker, exploit, infrastructure, kaspersky, malicious, malwareA novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs to spread malicious containers and mine Dero cryptocurrency. Dubbed a “Docker zombie outbreak” by cybersecurity researchers at Kaspersky, this attack leverages a self-replicating propagation mechanism to transform compromised containers into “zombies” that mine cryptocurrency and infect new victims. The campaign, detected…
-
Für Kryptomining: Neuer Zombie-Trojaner beißt sich durch Docker-Container
Nginx ist nicht nur ein Webserver. Ein Trojaner missbraucht diesen Namen, um unbemerkt und automatisiert Docker-Container zu infiltrieren. First seen on golem.de Jump to article: www.golem.de/news/fuer-kryptomining-neuer-zombie-trojaner-beisst-sich-durch-docker-container-2505-196424.html