Crypto-Mining Malware Outsmarting Image Scanners

The report describes crypto-mining malware distributed as Docker images that evolved from clear-text payloads to a more evasive variant which embeds a gzip-compressed, base64-encoded toolset inside ELF binaries to hide scripts from image scanners; it documents the unpack/decode sequence, shows how the miner and propagation components run, and recommends runtime controls such as image-to-container drift prevention to detect and block these obfuscated payloads.