Malwaremedium
Docker Malware Exploits Teneo Web3 Node to Earn Crypto via Fake Heartbeat Signals
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-26187 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function | 9.8 | 20% | PoC | |
| CVE-2022-26210 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU… | 9.8 | 6% | PoC | |
| CVE-2024-12987 | OS Command Injection in DrayTek Vigor2960/300B Web Interface | 6.9 | 98% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | teneo.pro | ns to unpack the actual code, which sets up a connection to teneo[.]pro. "The malware script simply connects to the WebSocket and |
From the original article
2 min read at thehackernews.com
Cybersecurity researchers have detailed a malware campaign that's targeting Docker environments with a previously undocumented technique to mine cryptocurrency. The activity cluster, per Darktrace and Cado Security , represents a shift from other cryptojacking campaigns that directly deploy miners like XMRig to illicitly profit off the compute resources.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.