Tuesday, April 1, 2025
HomecryptocurrencyHackers Abusing Docker Hub Account to Mine Monero Cryptocurrency

Hackers Abusing Docker Hub Account to Mine Monero Cryptocurrency

Published on

SIEM as a Service

Follow Us on Google News

Researchers observed a malicious Docker Hub account, “azurenql” that was active since October 2019 hosting malicious images to mine cryptocurrency, Monero.

According to wallet IDs, it was found the attacker earned 525.38 XMR, which roughly around 30000 USD based on today’s dollar price.

Docker is nothing but OS-level virtualization to deliver software in packages called containers. The dockers are popular nowadays, its popularity abused by attackers to make money by cryptojacking.

Malicious Docker Accounts

Researchers observed identified a user account named “azurenql” contains eight repositories hosting six malicious Monero mining images.

Docker Hub Account

Paloalto researchers observed that top image with Docker Hub account was pulled more than 1.47 million times. The base images use Ubuntu 16.04.6 LTS operating system.

To anonymize the traffic attackers uses Tor and it is configured to listen on its default port, 9050, here is the flow.

Docker Hub Account

Attackers used two methods to mine cryptocurrency by running these malicious images in the user’s environment.

Method 1: In the first method attackers directly submitting the mined blocks to the central minexmr pool using a wallet ID.

Method 2: In the second method attackers instances deployed on a hosting service running their mining pool that is used to collect mined blocks.

Researchers observed that wallet ID is still used and the recent mining activity for this wallet in April and May 2020.

Cryptomining attacks are increasing rapidly, attackers use to compromise servers, personal computers, Chrome extensions, and web portals to mine cryptocurrencies such as Monero.

The malicious activity was reported by Unit42 researchers to Docker Hub security and the malicious accounts taken down quickly.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

PortSwigger Launches Burp AI to Enhance Penetration Testing with AI

PortSwigger, the makers of Burp Suite, has taken a giant leap forward in the...

Chord Specialty Dental Partners Data Breach Exposes Customer Personal Data

Chord Specialty Dental Partners is under scrutiny after revealing a data breach that compromised...

Kentico Xperience CMS XSS Vulnerability Allows Remote Code Execution

Kentico Xperience CMS, a widely used platform designed for enterprises and organizations, is under...

LensDeal Data Breach Exposes 100,000 Customers’ Personal Information

A major data breach involving LensDeal, a Netherlands-based contact lens supplier, has reportedly exposed...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Threat Actors Compromise 150,000 Websites to Promote Chinese Gambling Platforms

A large-scale cyberattack has compromised approximately 150,000 legitimate websites by injecting malicious JavaScript to...

Fake Coinbase Migration Messages Target Users to Steal Wallet Credentials

A sophisticated phishing campaign is currently targeting cryptocurrency investors with fraudulent emails claiming to...

Crypto Platform OKX Suspends Tool Abused by North Korean Hackers

Cryptocurrency platform OKX has announced the temporary suspension of its Decentralized Exchange (DEX) aggregator...