When Malware Abused Docker

Malware actors are increasingly setting their sights on Docker. Docker, as a PaaS platform, enables OS, firmware, and apps to run within a container. This enclosed environment benefits developers when they’re looking to try out code. However, it also grants nefarious individuals a way to spawn a malware infection within an organization.

It’s therefore no surprise that malicious actors have abused Docker containers over the past several years. Here are just a few malware incidents that stand out.

The End of CoinHive and the Rise of Cryptojacking

CoinHive is a service that was created in September 2017. It allows users to mine Monero cryptocurrency using JavaScript. CoinHive has remarkably changed the income models of content developers over the course of its 18 month-long adventure. However, due in large part to the drop in hash rate (over 50 percent) after a previous Monero hard fork, and the crash of the market with the value of XMR depreciating more than 85 percent in one year, the service ended March 8, 2019. In this blog post, we look at how crypto mining has developed and how attackers have taken advantage of these models to develop a new attack vector called cryptojacking.

The Beginning of ByteCoin and Monero

In 2013, Nicolas van Saberhagen released the CryptoNote protocol. It was commonly used on the infrastructure of many coin types, including ByteCoin. The inventor of ByteCoin has been unknown since he announced the cryptocurrency anonymously on the Bitcointalk forum.