Docker Remote API servers Exploited

Cybercriminals are exploiting misconfigured Docker Remote API servers to deploy the Gafgyt malware, enabling them to launch Distributed Denial-of-Service (DDoS) attacks. Originally targeting Internet of Things (IoT) devices, Gafgyt has expanded its reach to include Docker environments. Attackers gain unauthorized access by deploying malicious containers using the Alpine Linux image, employing techniques like chroot and bind mounts to escalate privileges and compromise host systems. Once the Gafgyt botnet binary, such as “rbot” or “atlas.i586,” is executed, it connects to a command-and-control server to receive instructions for initiating multi-vector DDoS attacks utilizing UDP, TCP, and HTTP protocols. To mitigate these threats, organizations should implement robust access controls and authentication mechanisms for Docker Remote API servers, avoid running containers in privileged mode, and conduct thorough reviews of container images and configurations before deployment.

Source: Cyber Press