Vulnerabilitymedium
Commando Cat Cryptojacking Attacks Target Misconfigured Docker Instances
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-20062 | Unauthenticated Remote Code Execution in ThinkPHP-based noneCms 1.3 | 9.8 | 100% | KEVPoC ×2 | KEV |
| CVE-2019-9082 | Unauthenticated RCE in ThinkPHP < 3.2.4 (Open Source BMS, ZzzCMS zzzphp) | 8.8 | 97% | KEVPoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | anondns.net | ry using a curl or wget command from a C&C server ("leetdbs.anondns[.]net/z") by means of a shell script. The binary is suspected t |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Jun 07, 2024 Cryptojacking / Vulnerability The threat actor known as Commando Cat has been linked to an ongoing cryptojacking attack campaign that leverages poorly secured Docker instances to deploy cryptocurrency miners for financial gain. "The attackers used the cmd.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.