- 8 ways diversity and inclusion help teams perform better
- AI has grown beyond human knowledge, says Google's DeepMind unit
- Microsoft still has a massive Windows 10 problem - and there's no easy way out
- Midnight Blizzard Targets European Diplomats with Wine Tasting Lure
- AI 시대의 또 다른 과제 ‘데이터 자신감 격차’··· IT 리더가 관리해야 할 이유
Xanthe – Docker aware miner – Cisco Blogs
By Vanja Svajcer and Adam Pridgen, Cisco Incident Command
Attackers are constantly reinventing ways of monetizing their tools. Cisco Talos recently discovered an interesting campaign affecting Linux systems employing a multi-modular botnet with several ways to spread and a payload focused on providing financial benefits for the attacker by mining Monero online currency.
The actor employs various methods to spread across the network, like harvesting client-side certificates for spreading to known hosts using ssh, or spreading to systems with an incorrectly configured Docker API.
We believe this is the first time anyone’s documented Xanthe’s operations. The actor is actively maintaining all the modules and has been active since March this year.
Share:
