Updated: New Evidence Emerges to Suggest WatchDog Was Behind Crypto CampaignPalo Alto Unit 42·Jun 6, 01:12 UTC · Jun 6, 2024Threat actor45
Beapy Cryptojacking campaign leverages EternalBlue exploit to spreadSecurity Affairs·Apr 26, 19:36 UTC · Apr 26, 2019Threat actorCVE-2017-5638CVE-2017-12615CVE-2017-1027160
Cryptojacking Campaign Exploits Driver to Boost Monero MiningInfosecurity Magazine·Feb 18, 16:00 UTC · Feb 18, 2026Threat actorCVE-2020-14979150
Cryptojacking campaign relies on DevOps toolsSecurity Affairs·Jun 3, 07:17 UTC · Jun 3, 2025Threat actorCVE-2020-14144260
Malicious Microsoft VS Code Extensions Used in Cryptojacking CampaignInfosecurity Magazine·Apr 7, 16:01 UTC · Apr 7, 2025Threat actor45
EleKtra-Leak Cryptojacking Attacks Exploit AWS IAM Credentials Exposed on GitHubThe Hacker News·Nov 2, 03:54 UTC · Nov 2, 2023Threat actor145
New AMBERSQUID Cryptojacking Operation Targets Uncommon AWS ServicesThe Hacker News·Sep 19, 03:40 UTC · Sep 19, 2023Threat actor45
Kiss-a-Dog Cryptojacking Campaign Targets Docker and KubernetesInfosecurity Magazine·Oct 27, 18:00 UTC · Oct 27, 2022Threat actor57
Cryptojacking campaign targets addCyberScoop·Sep 14, 19:39 UTC · Sep 14, 2018Threat actor in the wild60
Cryptojacking Campaign Targets DevOps Servers Including NomadInfosecurity Magazine·Jun 2, 15:00 UTC · Jun 2, 2025Threat actorCVE-2020-14144160
Exposed Docker APIs Under Attack in 'Commando Cat' Cryptojacking CampaignThe Hacker News·Feb 1, 15:15 UTC · Feb 1, 2024Threat actor57
New Cryptojacking Campaign Leverages Misconfigured Redis Database ServersThe Hacker News·Mar 3, 04:24 UTC · Mar 3, 2023Threat actor45
Cryptojacking campaign targets insecure Redis serversSecurity Affairs·Mar 2, 18:00 UTC · Mar 2, 2023Threat actor45
Cryptojacking Campaign Exploits DevOps APIs Using Off-theThe Hacker News·Jun 3, 07:04 UTC · Jun 3, 2025Threat actorCVE-2020-14144160
New Cryptojacking Operation Targeting Kubernetes Clusters for Dero MiningThe Hacker News·Mar 15, 00:00 UTC · Mar 15, 2023Threat actor45
Compromised MikroTik routers power extensive cryptojacking campaignHelp Net Security·May 27, 07:36 UTC · May 27, 2020Threat actorCVE-2018-1484760
Hundreds of Docker Hosts compromised in cryptojacking campaignsSecurity Affairs·Mar 5, 12:13 UTC · Mar 5, 2019Threat actorCVE-2019-5736150
Cryptojacking campaign targets exposed Docker APIsSecurity Affairs·Jun 19, 07:31 UTC · Jun 19, 2024Threat actor57
Cryptojacking Campaign Targets Misconfigured Kubernetes ClustersThe Hacker News·Jun 15, 00:00 UTC · Jun 15, 2024Threat actor45
SCARLETEEL Cryptojacking Campaign Exploiting AWS Fargate in Ongoing CampaignThe Hacker News·Jul 15, 00:00 UTC · Jul 15, 2023Threat actor45
New Cryptojacking Campaign Targeting Vulnerable Docker and Kubernetes InstancesThe Hacker News·Mar 16, 13:33 UTC · Mar 16, 2023Threat actor57
MrbMiner cryptojacking campaign linked to Iranian software firmSecurity Affairs·Jan 23, 16:06 UTC · Jan 23, 2021Threat actor57
Cryptojacking campaign uses Shodan to scan for Docker hosts to hackSecurity Affairs·Jun 1, 12:29 UTC · Jun 1, 2019Threat actor145
Other 3,700 MikroTik Routers compromised in cryptoJacking campaignsSecurity Affairs·Sep 11, 06:32 UTC · Sep 11, 2018Threat actorCVE-2018-1484760
Cybercriminals Hijacking Vulnerable SSH Servers in New Proxyjacking CampaignThe Hacker News·Jul 1, 05:48 UTC · Jul 1, 2023Threat actor45
Attackers increasingly using transfer.sh to host malicious codeHelp Net Security·Mar 29, 16:08 UTC · Mar 29, 2023Threat actor45
Threat actors thriving on the fear and uncertainty of remote workforcesHelp Net Security·Mar 17, 00:00 UTC · Mar 17, 2021Threat actor60
How North Korea Revolutionized the Internet as a Tool for Rogue RegimesRecorded Future·Apr 23, 00:00 UTC · Apr 23, 2019Threat actor60
Wormable XMRig campaign leverages BYOVD and timed kill switch for stealthSecurity Affairs·Feb 23, 18:36 UTC · Feb 23, 2026Threat actor60
Crypto mining campaign targets Docker environments with new evasion techniqueSecurity Affairs·Apr 23, 18:15 UTC · Apr 23, 2025Threat actor45
Threat actors exploit Atlassian Confluence bug in cryptomining campaignsSecurity Affairs·Aug 30, 08:12 UTC · Aug 30, 2024Threat actor in the wildCVE-2023-2252760
Nansh0u campaign already infected 50K MSSecurity Affairs·May 30, 06:54 UTC · May 30, 2019Threat actorCVE-2014-411360
STOLEN PENCIL campaign, hackers target academic institutions.Security Affairs·Dec 9, 10:51 UTC · Dec 9, 2018Threat actor57
Hundreds of thousands MikroTik Routers involved in cryptomining campaignSecurity Affairs·Aug 3, 07:00 UTC · Aug 3, 2018Threat actor60
Wormable XMRig Campaign Uses BYOVD Exploit and TimeThe Hacker News·Feb 24, 11:56 UTC · Feb 24, 2026Threat actorCVE-2020-14979CVE-2025-5518260
⚡ Weekly Recap: Lazarus Hits Web3, Intel/AMD TEEs Cracked, Dark Web Leak Tool & MoreThe Hacker News·Nov 3, 17:59 UTC · Nov 3, 2025Threat actorCVE-2025-61932CVE-2025-55315CVE-2025-10680+18 CVEs160
Threat Actors Continue to Abuse Google Tag Manager for Payment Card e-SkimmingRecorded Future·Aug 22, 00:00 UTC · Aug 22, 2025Threat actor45
Threat Actor Mimo Targets Magento and Docker to Deploy Crypto Miners and ProxywareThe Hacker News·Jul 23, 17:15 UTC · Jul 23, 2025Threat actorCVE-2025-3243260
Over 1,500 PostgreSQL Servers Compromised in Fileless Cryptocurrency Mining CampaignThe Hacker News·Apr 1, 17:08 UTC · Apr 1, 2025Threat actor45