Docker Zombie Malware Spreads Through Containers to Mine Cryptocurrency and Self-Replicate

A sophisticated malware campaign targeting Docker container environments has been detected, leveraging insecurely exposed Docker APIs to launch a rapidly spreading “zombie” outbreak within containerized infrastructures.

The malware, designed for both propagation and illicit cryptocurrency mining, is capable of autonomously compromising containers and creating new malicious instances without the need for a command-and-control server, resulting in exponential infection rates and persistent resource hijacking.

Technical Analysis of the Infection Chain

The attack vector exploits Docker APIs exposed over the internet, specifically targeting port 2375.

Upon gaining access, the threat actor deploys two major Golang-based malware components, both packed with UPX to evade static detection.

The first is a previously undocumented propagation implant, masquerading as “nginx,” and the second is a Dero cryptocurrency miner known as “cloud”.

The “nginx” malware is engineered to ensure miner persistence and facilitate lateral movement within and across networks.

After compromising a Docker environment, it creates a log file (/var/log/nginx.log) to document infection activities and maintains a sentinel file (/usr/bin/version.dat with the value “1.4”) as a marker for infected containers.

According to Kaspersky Report, the malware continually verifies and restores this marker to identify and avoid redundant infections.

In parallel, the malware monitors for the miner process (“cloud”) and relaunches it if terminated.

The propagation logic is fully automated: “nginx” generates random IPv4 /16 subnets and utilizes the masscan tool to scan for hosts with open Docker APIs.

Upon identification, it remotely interacts with the Docker daemon, injecting a new malicious Ubuntu 18.04 container configured with masscan and Docker tools.

The malware then copies its binaries into the new container and modifies /root/.bash_aliases to ensure persistence on shell login.

This infection procedure is repeated for pre-existing Ubuntu-based containers missing the infection marker, thus maximizing the worm’s spread.

Autonomous Mining Operations

The “cloud” component is a Dero cryptocurrency miner, derived from the open-source DeroHE CLI project, hardcoded with an encrypted wallet configuration and node addresses.

On execution, it decrypts these values, establishing illicit mining operations directed to the threat actor’s Dero wallet.

The miner is stealthily launched and maintained by the propagation malware to ensure uninterrupted fraudulent activity.

Notably, this campaign requires no C2 infrastructure for coordination. Each infected container independently seeks additional vulnerable targets, creating a decentralized, self-replicating network of malicious miners.

Analysts attribute the sophistication of the malware’s self-spreading capabilities and its evasion techniques such as masquerading malware binaries and encrypting critical configurations to ongoing evolution in cloud-targeted threat landscapes.

Shodan data reveals over 500 Docker APIs exposed globally as of April 2025, amplifying the threat’s reach.

Merely using trusted images and best practices in container management does not provide absolute protection; runtime monitoring remains essential.

Security researchers highlight the need for continuous auditing of Docker configurations, strict API access controls, network segmentation, and deployment of advanced container monitoring solutions.

Incident response teams are advised to proactively hunt for anomalous activities in containerized environments and to utilize specialized tools for real-time detection and remediation.

The absence of a central C2 server in such campaigns complicates traditional takedown measures, underscoring the importance of preventive security and timely threat intelligence.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates