A novel Linux-based malware campaign has been identified, exploiting unprotected Docker infrastructure globally and transforming compromised servers into an integral part of a decentralized network dedicated to mining Dero, a cryptocurrency that prioritizes user privacy, currently valued at $0.3014. According to a report published by the cybersecurity firm Kaspersky, the malicious operation initiates by exploiting publicly accessible Docker APIs via port 2375.

Upon gaining access, the malware deploys rogue containers and infects existing ones, thereby commandeering system resources to mine Dero and scan for additional targets without necessitating a central command server. Docker, in software terms, refers to a suite of applications or platform tools and products that leverage OS-level virtualization to deliver software in compact packages known as containers. The threat actor behind this operation has deployed two Golang-based implants: 'nginx', which masquerades as the legitimate web server software, and 'cloud', the actual mining software utilized for Dero generation.

Once a host is compromised, the 'nginx' module continuously scans the internet for vulnerable Docker nodes, utilizing tools like Masscan to identify targets and deploy new infected containers. Researchers have described the campaign as behaving like a 'zombie container outbreak', where one infected node autonomously creates new 'zombies' to mine Dero and propagate further, requiring no external control beyond additional misconfigured Docker endpoints.

To evade detection, the malware encrypts configuration data, including wallet addresses and Dero node endpoints, disguising itself under paths typically associated with legitimate system software. Kaspersky has identified the same wallet and node infrastructure used in previous cryptojacking campaigns targeting Kubernetes clusters in 2023 and 2024, indicating an evolution of a known operation rather than a novel threat.

However, the incorporation of self-spreading worm logic and the absence of a central command server render this campaign particularly resilient and challenging to dismantle. As of early May, over 520 Docker APIs were found to be publicly exposed over port 2375 worldwide, each posing a potential target for this malicious campaign.