Full Report
Kaspersky experts break down an updated cryptojacking campaign targeting containerized environments: a Dero crypto miner abuses the Docker API.
Analysis Summary
The provided context extensively details cookie consent settings and website navigation links from the Securelist article page, but **it does not contain the actual substance, technical details, or description of the Dero miner attack or its TTPs.**
Therefore, the summary below is based *only* on the title and brief description provided, which names the malware family and its primary infection vector/target environment. Specific details like IOCs, MITRE mappings, and exact capabilities cannot be extracted from the given text fragment.
***
# Tool/Technique: Dero Miner (Containerized Linux Infection)
## Overview
This refers to the Dero cryptocurrency mining malware that is actively targeting and spreading within containerized Linux environments, leveraging vulnerabilities or misconfigurations related to the Docker API for infection.
## Technical Details
- Type: Malware family (Cryptominer)
- Platform: Linux (specifically targeting Docker/containerized environments)
- Capabilities: Cryptocurrency mining, lateral movement/infection within container hosts.
- First Seen: Not specified in the provided context excerpt.
## MITRE ATT&CK Mapping
*(No specific mappings can be derived from the provided context excerpt)*
- TBD - Tactic Name
- T#### - Technique Name
- T####.### - Sub-technique if applicable
## Functionality
### Core Capabilities
- Infection of containerized Linux hosts.
- Exploitation or abuse of the Docker API to gain initial foothold or spread.
- Deployment of cryptocurrency mining routines (Dero).
### Advanced Features
- Unknown/Not specified in the context excerpt, likely focused on persistence and resource utilization for mining.
## Indicators of Compromise
*(No specific IOCs are provided in the context excerpt)*
- File Hashes: [N/A]
- File Names: [N/A]
- Registry Keys: [N/A]
- Network Indicators: [N/A] (C2 information is absent)
- Behavioral Indicators: [N/A]
## Associated Threat Actors
- Undetermined based on the provided text summary (Dero miners are often opportunistic, but sustained campaigns may be linked to specific groups).
## Detection Methods
*(Inferred based on the mechanism)*
- Signature-based detection: Targeting known Dero miner binaries or scripts.
- Behavioral detection: Monitoring for unusual outbound network connections soliciting mining pools or unusual process execution originating from Docker/container management services.
- YARA rules: Potentially for specific binary hashes or strings related to Dero mining code.
## Mitigation Strategies
- Least Privilege: Ensure the Docker daemon/API is not exposed unnecessarily or configured with excessive privileges to the network.
- Network Segmentation: Isolate container hosts from unauthorized access.
- Principle of Least Access: Limit the permissions granted to running containers.
- Hardening: Ensure Docker configurations restrict access to the Docker socket/API.
## Related Tools/Techniques
- Other cryptocurrency mining malware (e.g., Kinsing, XMRig derivatives).
- Techniques leveraging exposed cloud/container APIs for initial access.