LemonDuck bot Points Docker Cloud Instances to Mine Cryptocurrency on Linux Systems

LemonDuck is a cryptocurrency mining bot that uses Docker cloud instances to mine cryptocurrency on Linux platforms. The LemonDuck botnet attempts to monetize its efforts, according to the CrowdStrike Cloud Risk Analysis team, by running concurrent campaigns to mine cryptocurrency like Monero. According to the researchers, because Docker is typically used to execute container workloads in the cloud, a misconfigured cloud event can expose a Docker API to the internet. An attacker can then use this API to launch a cryptocurrency miner inside a container controlled by the attacker. As cloud use grows across various businesses, attacks like this may become more common, according to Dave Cundiff, CISO of Cyvatar. According to Cundiff, Docker and other similar tools are extremely useful in improving day-to-day workflow for businesses to meet the growing demands of their customers. On the other hand, Cundiff believes that directors frequently underestimate the need for safety in containerized environments. Containers offer more secure settings, but Cundiff warns that “simple misconfigurations could enable these types of assaults.” “As demonstrated in the CrowdStrike study, an incorrectly exposed API to the internet allows attackers to exploit the target infrastructure before pivoting internally to other containers.” The finest first step in protecting the environment is to keep your surroundings clean.” While Docker provides a high l...