DERO cryptojacking campaign (2024) (Campaign)

Wiz Threat Research identified a DERO cryptojacking campaign that exploits Kubernetes clusters with anonymous API-server access to deploy UPX-packed miner containers from Docker Hub. The attackers use benign-sounding container names, hardcoded/encrypted wallet and mining pool details to evade detection, update repository images and domains to hide communications, and employ additional tools (dropper scripts, misconfiguration exploitation) to propagate and suppress competing miners, suggesting a persistent, adaptive operation across cloud environments.