'Commando Cat' Is Second Campaign of the Year Targeting Docker

Commando Cat is an active, sophisticated cryptojacking campaign abusing exposed Docker API endpoints to mount host filesystems and run payloads on the host; it combines a cryptocurrency miner with credential-stealing and backdoor capabilities, demonstrates strong evasion and redundancy, and shows overlaps with known tooling/IPs associated with groups like Team TNT.