Cloud-y Linux Malware Rains on Apache, Docker, Redis & Confluence

Cado Security observed a campaign called "Spinning YARN" that scans for cloud misconfigurations and an RCE in Confluence (CVE-2022-26134) to compromise servers running Hadoop YARN, Confluence, Docker, and Redis. The actor deploys Golang payloads, a Monero miner (XMRig), the Platypus reverse shell, and user-mode rootkits to establish persistence and evade detection, indicating active exploitation of Internet-facing cloud services and container environments.