Docker Malware Exploits Teneo Web3 Node to Earn Crypto via Fake Heartbeat Signals
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-26187 | TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. NVD description · AI analysis pending | 9.8 | 20% | PoC |
| — | |
| CVE-2022-26210 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128 Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185_B20201128, and A810R V4.1.2cu.5182_B20201026 were discovered to contain a command injection vulnerability in the function setUpgradeFW, via the FileName parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. NVD description · AI analysis pending | 9.8 | 6% | PoC |
| — | |
| CVE-2024-12987 | OS Command Injection in DrayTek Vigor2960/300B Web Interface CVE-2024-12987 is an OS command injection flaw in the web management interface of DrayTek Vigor2960 and Vigor300B routers running firmware 1.5.1.4. An unauthenticated remote attacker triggers it by sending a crafted request to the /cgi-bin/mainfunction.cgi/apmcfgupload endpoint with a manipulated 'session' parameter, which is passed to the underlying operating system without proper sanitization (CWE-77/CWE-78). Successful exploitation yields arbitrary operating-system command execution on the router, which can mean full device compromise and a foothold for pivoting into the protected network. Any organization running affected firmware on these models is exposed, especially sites where the management interface is reachable from the internet. Exploitation is confirmed in the wild: a public proof-of-concept is available, EPSS assigns a 98.1% probability of exploitation within 30 days (100th percentile), and CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-05-15, requiring federal remediation under BOD 22-01. Do: Upgrade Vigor2960 and Vigor300B units from firmware 1.5.1.4 to version 1.5.1.5 or later. Until patched, restrict internet-facing access to the web management interface and review device logs for suspicious requests to /cgi-bin/mainfunction.cgi/apmcfgupload containing anomalous session parameters. Because the flaw is in CISA's KEV catalog, federal agencies must apply the vendor fix or applicable BOD 22-01 mitigations by the required deadline. | 6.9 | 98% | KEV PoC |
| largeplausibly tens of thousands of internet-exposed devices |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | teneo.pro | ns to unpack the actual code, which sets up a connection to teneo[.]pro. "The malware script simply connects to the WebSocket and |
Full article499 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 22, 2025IoT Security / Malware
Cybersecurity researchers have detailed a malware campaign that's targeting Docker environments with a previously undocumented technique to mine cryptocurrency.
The activity cluster, per Darktrace and Cado Security, represents a shift from other cryptojacking campaigns that directly deploy miners like XMRig to illicitly profit off the compute resources.
This involves deploying a malware strain that connects to a nascent Web3 service called Teneo, a decentralized physical infrastructure network (DePIN) that allows users to monetize public social media data by running a Community Node in exchange for rewards called Teneo Points, which can be converted into $TENEO Tokens.
The node essentially functions as a distributed social media scraper to extract posts from Facebook, X, Reddit, and TikTok.
An analysis of artifacts gathered from Darktrace's honeypots has revealed that the attack starts with a request to launch a container image "kazutod/tene:ten" from the Docker Hub registry. The image was uploaded two months ago and has been downloaded 325 times to date.
The container image is designed to run an embedded Python script that's heavily obfuscated and requires 63 iterations to unpack the actual code, which sets up a connection to teneo[.]pro.
"The malware script simply connects to the WebSocket and sends keep-alive pings in order to gain more points from Teneo and does not do any actual scraping," Darktrace said in a report shared with The Hacker News. "Based on the website, most of the rewards are gated behind the number of heartbeats performed, which is likely why this works."
The campaign is reminiscent of another malicious threat activity cluster that's known to infect misconfigured Docker instances with the 9Hits Viewer software in order to generate traffic to certain sites in exchange for obtaining credits.
The intrusion set is also similar to other bandwidth-sharing schemes like proxyjacking that involve downloading a specific software to share unused internet resources for some sort of financial incentive.
"Typically, traditional cryptojacking attacks rely on using XMRig to directly mine cryptocurrency, however as XMRig is highly detected, attackers are shifting to alternative methods of generating crypto," Darktrace said. "Whether this is more profitable remains to be seen."
The disclosure comes as Fortinet FortiGuard Labs revealed a new botnet dubbed RustoBot that's propagating through security flaws in TOTOLINK (CVE-2022-26210 and CVE-2022-26187) and DrayTek (CVE-2024-12987) devices with an aim to conduct DDoS attacks. The exploitation efforts have been found to primarily target the technology sector in Japan, Taiwan, Vietnam, and Mexico.
"IoT and network devices are often poorly defended endpoints, making them attractive targets for attackers to exploit and deliver malicious programs," security researcher Vincent Li said. "Strengthening endpoint monitoring and authentication can significantly reduce the risk of exploitation and help mitigate malware campaigns."
Update
The container image is no longer available for download from Docker Hub. The account continues to remain active.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/04/docker-malware-exploits-teneo-web3-node.html