Full Report
On 2020-07-28, a campaign was reported, involving Doki operator, gaining initial access via Software misconfig, while using Exploiting host mount to escape to host, targeting Docker to achieve Resource hijacking.
Analysis Summary
# Incident Report: Doki Cryptojacking Campaign Targeting Docker Environments
## Executive Summary
A cryptojacking campaign attributed to the Doki operator was reported in July 2020, leveraging software misconfigurations in cloud environments for initial access. The attackers utilized the high-privilege technique of exploiting host mounts within Docker containers to achieve a container escape, culminating in resource hijacking for cryptocurrency mining. Response actions focused on understanding and mitigating the container escape vulnerability.
## Incident Details
- Discovery Date: July 28, 2020 (Date the campaign was reported/observed)
- Incident Date: Occurred around or prior to July 28, 2020
- Affected Organization: Undisclosed cloud/container users
- Sector: Cloud Services, Technology
- Geography: Undisclosed (Implied global cloud infrastructure)
## Timeline of Events
### Initial Access
- Date/Time: Prior to 2020-07-28
- Vector: Software misconfiguration
- Details: Attackers exploited incorrectly configured software, likely within a cloud-hosted Docker deployment, to gain an initial foothold.
### Lateral Movement
- Details: The primary progression involved escalating privileges from within the container environment to the underlying host system using a container escape technique.
- **Technique:** Exploiting host mount access to escape the container boundary.
### Data Exfiltration/Impact
- Impact: Resource hijacking, specifically the use of victim infrastructure CPU/resources for unauthorized cryptocurrency mining (cryptojacking).
### Detection & Response
- Details: The campaign was publicly reported based on threat intelligence feeds monitoring cloud attacks. Response would have involved isolating compromised containers and hosts, and patching configuration errors.
## Attack Methodology
- Initial Access: Software misconfig
- Persistence: Not explicitly detailed, but typically involves deploying coin miners or backdoors (common in Doki).
- Privilege Escalation: Exploiting host mount access to escape the container.
- Defense Evasion: Standard malware techniques (not detailed).
- Credential Access: Not explicitly detailed.
- Discovery: Not explicitly detailed.
- Lateral Movement: Limited scope detailed; focused on achieving host access from container.
- Collection: Not applicable (Primary goal was resource hijacking).
- Exfiltration: Not applicable (Primary goal was resource usage).
- Impact: Resource hijacking (Cryptojacking).
## Impact Assessment
- Financial: Costs associated with resource usage (cloud bills) and incident remediation.
- Data Breach: No evidence of specific data exfiltration mentioned; impact is operational resource theft.
- Operational: Degradation of host system performance due to unauthorized cryptocurrency mining.
- Reputational: Potential impact on hosting providers or organizations running vulnerable Docker instances.
## Indicators of Compromise
*Note: Specific IOCs were not provided in the source material.*
- Network indicators: (Likely communication to known mining pools - defanged)
- File indicators: (Doki malware artifacts)
- Behavioral indicators: Excessive CPU utilization on Docker hosts; execution of unknown processes within containers.
## Response Actions
- Containment measures: Isolating affected containers and hosts; stopping unauthorized processes.
- Eradication steps: Removing the Doki malware payload and ensuring configuration flaws are fixed.
- Recovery actions: Restoring normal operations after ensuring all persistence mechanisms are removed.
## Lessons Learned
- Vulnerable software configurations in cloud environments (especially related to volume mappings in Docker) provide a direct path to critical host compromise.
- Container escapes remain a primary path for sophisticated cloud threat actors to transition from isolated application compromise to full system resource theft.
## Recommendations
- Strictly enforce the principle of least privilege for all container deployments, especially regarding host volume mounts.
- Audit Docker configurations regularly to ensure sensitive host directories are not unnecessarily mounted into running containers.
- Implement advanced runtime security monitoring within container environments specifically designed to detect resource exhaustion or unexpected process execution indicative of cryptojacking.