'Commando Cat' Digs Its Claws Into Exposed Docker Containers

Commando Cat is an active cryptojacking campaign exploiting misconfigured Docker remote API servers: attackers deploy benign containers, use chroot and volume binding to escape containers to the host, establish C2, and install cryptocurrency miners. Trend Micro and Cado Security recommend using only official images, avoiding running containers as root, performing regular security audits, and ensuring Docker APIs are not exposed to the Internet.