Cryptocurrency Miners Abusing Containers: Anatomy of an Attack

This report describes a honeypot study of automated attackers scanning for exposed Docker daemons and attempting to deploy Monero cryptocurrency miners. The adversary probed the Docker API to identify versioning, tried multiple image injection techniques (docker import, docker build, and pulling public miner images), and repeatedly attempted to create and start mining containers; all runtime attempts were blocked by Aqua CSP, allowing observation of attacker behavior without system compromise.