Hackers mined $90,000 worth of Monero with a simple Docker Hub trick

The malicious images were stored on Docker Hub for about a year before they were taken down.

A series of malicious cryptojacking files that were stored on Docker Hub, a code repository site, have been downloaded more than 5 million times over the last year, helping a hacker infect countless computers that were used to mine about $90,000 worth of Monero, according to research from cybersecurity company Kromtech.

Monero is a popular cryptocurrency that’s become known for its usage among cyber criminals.

In a blog post published Tuesday, Kromtech discussed how the boobytrapped files had remained on Docker Hub for so long despite being noticed and reported multiple times.

Docker Hub is a repository site for containerized applications. Kromtech describes these containers as a “way of packaging software.” They are also referred to as images, container images or Docker images.

“You can think of running a container like running a virtual machine, without the overhead of spinning up an entire operating system,” Kromtech explains.

Kromtech lists tweets and comments on GitHub showing that some users noticed the malicious docker files with embedded cryptomining tools at least as far back as August 2017.

https://twitter.com/jperras/status/894561761252319232

It wasn’t just scattered tweets and comments. Cybersecurity companies Sysdig and Fortinet publicly reported on malware posted on Docker Hub by the account docker123321 earlier this year.

According to Kromtech, Docker Hub took down the offending account last month, about a week after Fortinet published its report. But it had been at least eight months since people first started reporting the malicious images.

The account was created in May 2017 and had stored 17 malicious container images that were “pulled” about 5 million times.

The files, once downloaded from Docker Hub by victims, will run scripts that give the attacker persistent access to the victim’s server, allowing them to run whatever code they want. In this case, the focus was on mining Monero using the victims’ computing power.

Kromtech says that a Monero wallet address linked to the attackers managed to collected upwards of 544 units of Monero, worth roughly $90,000.

While the images have now been removed from Docker Hub, they could potentially still be exploiting other servers of Docker Hub users that already accessed them.

Kromtech warns users to vet images before pulling them, given how easily hackers in this case were able to exploit victims.

“For ordinary users, just pulling a Docker image from the DockerHub is like pulling arbitrary binary data from somewhere, executing it, and hoping for the best without really knowing what’s in it,” Kromtech researchers write. “You need to ask yourself whether you’re able to monitor what’s going on inside a pod or container to determine if there is a potential exploit.”

In February, Tesla was revealed to have fallen victim to a cryptojacking scheme through Kubernetes, another tool used to configure containerized applications.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure