New Malware Targets Exposed Docker APIs for Cryptocurrency Mining

Researchers reported a cryptojacking campaign abusing exposed Docker API endpoints (port 2375) and misconfigured services to deploy a multi-stage infection chain of shell scripts and Go binaries that provide remote access, lateral movement (exeremo), evasion (fkoths), and an XMRig miner; the campaign shows overlaps with the earlier 'Spinning YARN' activity and a shift toward Go-based payloads to complicate analysis.