Exposed Docker APIs Under Attack in 'Commando Cat' Cryptojacking Campaign

Commando Cat is an active cryptojacking campaign targeting exposed Docker API endpoints that deploys a seemingly benign container, escapes to the host using chroot, and drops multiple payloads to establish persistence, backdoor the host, exfiltrate cloud credentials, and run an XMRig cryptocurrency miner; the campaign uses evasion techniques (e.g., /dev/shm and Base64-encoded scripts) and shows overlap with prior cryptojacking groups like TeamTNT.