THE NINE LIVES OF COMMANDO CAT

Summary from the TLDR InfoSec newsletter

Commando Cat is a novel infostealer malware campaign that targets unsecured Docker API endpoints. The attack begins by launching the malicious Docker container and then escaping to the host. The malware then installs several backdoors and a credential stealer. It removes any other crypto miners and black holes in the Docker registry to prevent competition. This post includes IoCs and Yara rules.