Pause off my cluster: DERO cryptojacking takes a new shape
ID: de67d023-eeb1-5d35-895f-1b432958ce38
STIX ID: report--de67d023-eeb1-5d35-895f-1b432958ce38
Feed Name: Wiz Blog
Threat Score
This report details an active cryptojacking campaign abusing anonymous access to Internet-facing Kubernetes API servers to deploy UPX-packed DERO miners disguised as legitimate 'pause' containers; attackers hardcode/encrypt wallet and pool information, update Docker Hub images, and use supporting scripts/binaries (including a ddns.sh dropper and GMiner) to propagate and evade detection, with comprehensive IoCs and mitigation guidance provided.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.