Coinminer, DDoS Bot Attack Docker Daemon Ports

Researchers found an open directory containing malicious files, which was first reported in a series of Twitter posts by MalwareHunterTeam. Analyzing some of the files, we found a malicious cryptocurrency miner and Distributed Denial of Service (DDoS) bot that targets open Docker daemon ports.

The attack starts with the shell script named mxutzh.sh, which scans for open ports (2375, 2376, 2377, 4243, 4244) and then creates an Alpine Linux container that will host the coinminer and DDoS bot.

The container created by the shell script will download init.sh, another shell script that will drop and execute its other components:

• clean.sh – Searches for other coin miners and malware to clean/remove. It removes the Kinsing malware, which, according to reports, also targets vulnerable Docker servers.
• dns – The Kaiten/Tsunami DDoS bot
• lan.ssh.kinsing.ssh – Attempts lateral movement via SSH
• NarrenKappe.sh – Configures the firewall to allow ports that will be used by the other components, and sinkholes other domain names by editing the /etc/hosts file. It also exfiltrates sensitive information from its host machine.
• setup.basics.sh – Ensures that the utilities needed by the other components are installed in the system.
• setup.mytoys.sh – Downloads the source code of a log cleaner and compiles it. The script also downloads punk.py, which is a post-exploitation tool that attackers may use to pivot to other devices in the network.
• setup.xmrig.curl.sh – Downloads and installs the coinminer payload.
• sysinfo – Acquires various system information and reports it back to its C&C server.

Misconfigured Docker containers have always been vulnerable to similar threats; attacks using botnets and cryptocurrency miners have also been spotted in the past. 

[Related: Container Security: Examining Potential Threats to the Container Environment]  

Defense against Docker-related attacks

As more workplaces embrace cloud environments, Docker containers are becoming more popular since they are relatively easy to deploy in a cloud. To protect these containers against attacks, the following practices are advised:

• Host containers in a container-focused OS to lessen the attack surface.
• Use controls such as intrusion prevention systems (IPS) and web filtering to examine network traffic.
• Limit access to only those who need it to lessen the chances of compromise.
• Perform the standard best practices.

Users can also rely on the following security solutions to protect Docker containers:

• Trend Micro Hybrid Cloud Security – provides automated security and protects physical, virtual, and cloud workloads.
• Trend Micro Cloud One™ - provides visibility and protection against threats 
• Trend Micro Cloud One™ - Container Security performs automated container image and registry scanning.
• For security as software: Trend Micro Deep Security™ Software (workload and container security) and Trend Micro Deep Security Smart Check (container image security) for scanning container images to detect malware and vulnerabilities early on.

Indicators of Compromise

URLs

• hxxp://45[.]9[.]148[.]123/COVID19/nk/NarrenKappe.sh
• hxxp://45[.]9[.]148[.]123/COVID19/sh/clean.sh
• hxxp://45[.]9[.]148[.]123/COVID19/sh/lan.ssh.kinsing.sh
• hxxp://45[.]9[.]148[.]123/COVID19/sh/setup.basics.sh
• hxxp://45[.]9[.]148[.]123/COVID19/sh/setup.mytoys.sh
• hxxp://45[.]9[.]148[.]123/COVID19/sh/setup.xmrig.curl.sh
• hxxp://teamtnt[.]red/dns
• hxxp://teamtnt[.]red/sysinfo
• hxxp://teamtnt[.]red/up/setup_upload.php
• irc[.]kaiserfranz[.]cc