--- title: New Self-Spreading Malware Infects Docker Containers to... description: A new malware campaign targets exposed Docker API instances, using them to create a botnet for mining Dero cryptocurrency. The malware spreads worm-like to... canonical: https://daily.dev/posts/new-self-spreading-malware-infects-docker-containers-to-mine-dero-cryptocurrency-ckimqedyb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Self-Spreading Malware Infects Docker Containers to Mine Dero Cryptocurrency | daily.dev og:description: A new malware campaign targets exposed Docker API instances, using them to create a botnet for mining Dero cryptocurrency. The malware spreads worm-like to... og:url: https://daily.dev/posts/new-self-spreading-malware-infects-docker-containers-to-mine-dero-cryptocurrency-ckimqedyb og:image: https://api.daily.dev/og/posts/ckiMqEDYb.png og:image:alt: New Self-Spreading Malware Infects Docker Containers to Mine Dero Cryptocurrency og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Self-Spreading Malware Infects Docker Containers to Mine Dero Cryptocurrency **[The Hacker News](https://daily.dev/sources/thn)** · 4 min read · 0 upvotes · 0 comments ## Summary A new malware campaign targets exposed Docker API instances, using them to create a botnet for mining Dero cryptocurrency. The malware spreads worm-like to other Docker containers, creating new malicious containers and compromising existing ones. Developed in Golang, it uses 'nginx' and 'cloud' payloads to disguise as legitimate software, ensuring persistence by modifying the system's startup settings. This attack highlights the need for secure Docker API configurations to prevent such vulnerabilities. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#cyber](https://daily.dev/tags/cyber), [#golang](https://daily.dev/tags/golang), [#docker](https://daily.dev/tags/docker), [#crypto](https://daily.dev/tags/crypto), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/new-self-spreading-malware-infects-docker-containers-to-mine-dero-cryptocurrency-ckimqedyb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Self-Spreading Malware Infects Docker Containers to Mine Dero Cryptocurrency","url":"https://daily.dev/posts/new-self-spreading-malware-infects-docker-containers-to-mine-dero-cryptocurrency-ckimqedyb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-self-spreading-malware-infects-docker-containers-to-mine-dero-cryptocurrency-ckimqedyb"},"datePublished":"2025-05-27T17:15:30.581Z","dateModified":"2025-05-27T17:15:43.684Z","description":"A new malware campaign targets exposed Docker API instances, using them to create a botnet for mining Dero cryptocurrency. The malware spreads worm-like to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a979838a47de88d49949ecaa3c58b17?_a=AQAEuj9","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9a979838a47de88d49949ecaa3c58b17?_a=AQAEuj9","isAccessibleForFree":true,"articleSection":"The Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/thn","url":"https://daily.dev/sources/thn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-self-spreading-malware-infects-docker-containers-to-mine-dero-cryptocurrency-ckimqedyb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,golang,docker,crypto,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Hacker News","item":"https://daily.dev/sources/thn"},{"@type":"ListItem","position":3,"name":"New Self-Spreading Malware Infects Docker Containers to Mine Dero Cryptocurrency"}]} ```