PANews reported on May 29 that according to CoinDesk, cybersecurity company Kaspersky discovered that a new Linux malware is attacking unprotected Docker infrastructure, using the exposed Docker API port 2375 to create malicious containers, forming a decentralized cryptojacking network to mine the privacy coin Dero. The malware uses two Golang implants: "nginx" is used to scan more vulnerable targets, and "cloud" is used for actual mining.

Researchers pointed out that the malware uses self-propagating worm logic, does not require a central command server, and hides itself by encrypting configuration data. As of early May, more than 520 Docker APIs were publicly exposed through port 2375 worldwide. This attack uses the same wallet and node infrastructure as the cryptojacking activities targeting Kubernetes clusters in 2023-2024, indicating that this is an upgraded version of a known threat.