Docker Swarm and K8s cryptojacking campaign

Datadog Security Research has uncovered a sophisticated cryptojacking campaign targeting microservice technologies, specifically Docker and Kubernetes. The threat actors exploit exposed Docker Engine APIs to gain initial access, deploying cryptocurrency miners on compromised containers. They then execute additional malicious payloads to facilitate lateral movement to other hosts running Docker, Kubernetes, or SSH services.

Notably, hardcoded file system paths in the payloads suggest that the attackers may be targeting compute infrastructure used for GitHub Codespaces.