Kinsing Cryptocurrency-Mining Malware Campaign Targets Docker Containers

Summary

Researchers at security firm Aqua detailed a malware operation targeting Docker container environments. Threat actors are scanning for and accessing Docker containers running API ports exposed to the internet to install a cryptocurrency-mining malware known as Kinsing. Using the API port, the threat actors can run an Ubuntu container to download and install Kinsing. Secondary functions of the malware include stealing local SSH credentials. Attacks began at the end of 2019 and are ongoing.

Recommendations

The NJCCIC recommends administrators of Docker containers refrain from exposing API ports to the internet and review the Aqua blog post.