Privacy Coin Dero suffers from a new type of self-propagating malware attack, with over 520 Docker APIs exposed worldwide.

On May 29, Coindesk reported that a new type of Linux malware is attacking unprotected Docker infrastructure across the globe, transforming exposed servers into a decentralized network for mining privacy coin Dero. The malware exploits the exposed Docker API via a port 2375 attack, deploying two Golang-based implants, one disguised as legitimate web server software ‘nginx’ and the other named ‘cloud’ for mining.

Infected nodes autonomously scan the internet for new targets and deploy infected containers, eliminating the need for a central control server. As of early May, more than 520 Docker APIs around the world were publicly exposed via port 2375 and were potential targets. The study revealed that the attack used the same wallet and node infrastructure as the attacks against Kubernetes clusters in 2023 and 2024.