Commando Cat Is Second Campaign of the Year Targeting Docker

The threat actor behind the campaign is still unknown, but it shares some similarities with other cyptojacking groups.

In findings released by Cado researchers, they discovered a malware campaign, coined Commando Cat, which is targeting exposed
Docker
API endpoints.
The
cryptojacking campaign
has only been active since the beginning of this year but its the second one targeting Docker. The first one used the 9hits traffic exchange application, according to the researchers. However, these Docker attacks arent necessarily rare,
especially in cloud environments
.
This campaign demonstrates the continued determination attackers have to exploit the service and achieve a variety of objectives,
the researchers said
. Commando Cat is a cryptojacking campaign leveraging Docker as an initial access vector and (ab)using the service to mount the hosts filesystem, before running a series of interdependent payloads directly on the host.
It is unclear who the threat actor behind Commando Cat is or where theyre from, though there is an overlap in scripts and IP addresses to other groups like Team TNT, indicating a potential connection or a copycat.
Because of the level of redundancy and the amount of evasion, the campaign is sophisticated in how it conceals itself. Acting as a
credential stealer
, backdoor, and cryptocurrency miner together as one, it makes for a highly stealthy and malicious threat.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Commando Cat Is Second Campaign of the Year Targeting Docker