Phone : +91 95 8290 7788 | Email :

Register & Request Quote | Submit Support Ticket

Home » Cyber Security News » Vulnerabilities & Exploits » Cryptojacking Campaign Targets Misconfigured Kubernetes Clusters

Cryptojacking Campaign Targets Misconfigured Kubernetes Clusters

Cryptojacking Campaign Targets Misconfigured Kubernetes Clusters

Jun 12, 2024NewsroomKubernetes / Endpoint Security

Cryptojacking Campaign

Cybersecurity researchers have warned of an ongoing cryptojacking campaign targeting misconfigured Kubernetes clusters to mine Dero cryptocurrency.

Cloud security firm Wiz, which shed light on the activity, said it’s an updated variant of a financially motivated operation that was first documented by CrowdStrike in March 2023.

“In this incident, the threat actor abused anonymous access to an Internet-facing cluster to launch malicious container images hosted at Docker Hub, some of which have more than 10,000 pulls,” Wiz researchers Avigayil Mechtinger, Shay Berkovich, and Gili Tikochinski said. “These docker images contain a UPX-packed DERO miner named ‘pause.'”

Initial access is accomplished by targeting externally accessible Kubernetes API servers with anonymous authentication enabled to deliver the miner payloads.

Unlike the 2023 version that deployed a Kubernetes DaemonSet named “proxy-api,” the latest flavor makes use of seemingly benign DaemonSets called “k8s-device-plugin” and “pytorch-container” to ultimately run the miner on all nodes of the cluster.


In addition, the idea behind naming the container “pause” is an attempt to pass off as the actual “pause” container that’s used to bootstrap a pod and enforce network isolation.

The cryptocurrency miner is an open-source binary written in Go that has been modified to hard-code the wallet address and custom Dero mining pool URLs. It’s also obfuscated using the open-source UPX packer to resist analysis.

The main idea is that by embedding the mining configuration within the code, it makes it possible to run the miner without any command-line arguments that are typically monitored by security mechanisms.

Wiz said it identified additional tools developed by the threat actor, including a Windows sample of a UPX-packed Dero miner as well as a dropper shell script that’s designed to terminate competing miner processes on an infected host and drop GMiner from GitHub.

“[The attacker] registered domains with innocent-looking names to avoid raising suspicion and to better blend in with legitimate web traffic, while masking communication with otherwise well-known mining pools,” the researchers said.

“These combined tactics demonstrate the attacker’s ongoing efforts to adapt their methods and stay one step ahead of defenders.”

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Information Security - InfoSec - Cyber Security - Firewall Providers Company in India













What is Firewall? A Firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies. At its most basic, a firewall is essentially the barrier that sits between a private internal network and the public Internet.


Secure your network at the gateway against threats such as intrusions, Viruses, Spyware, Worms, Trojans, Adware, Keyloggers, Malicious Mobile Code (MMC), and other dangerous applications for total protection in a convenient, affordable subscription-based service. Modern threats like web-based malware attacks, targeted attacks, application-layer attacks, and more have had a significantly negative effect on the threat landscape. In fact, more than 80% of all new malware and intrusion attempts are exploiting weaknesses in applications, as opposed to weaknesses in networking components and services. Stateful firewalls with simple packet filtering capabilities were efficient blocking unwanted applications as most applications met the port-protocol expectations. Administrators could promptly prevent an unsafe application from being accessed by users by blocking the associated ports and protocols.


Firewall Firm is an IT Monteur Firewall Company provides Managed Firewall Support, Firewall providers , Firewall Security Service Provider, Network Security Services, Firewall Solutions India , New Delhi - India's capital territory , Mumbai - Bombay , Kolkata - Calcutta , Chennai - Madras , Bangaluru - Bangalore , Bhubaneswar, Ahmedabad, Hyderabad, Pune, Surat, Jaipur, Firewall Service Providers in India

Sales Number : +91 95 8290 7788 | Support Number : +91 94 8585 7788
Sales Email : | Support Email :

Register & Request Quote | Submit Support Ticket