Undetectable Linux Malware Targeting Docker Servers With Exposed APIs

This article is based on research originally reported by The Hacker News and attributed to Intezer, published in July 2020.

Overview

Cybersecurity researchers at Intezer disclosed a Linux backdoor, dubbed Doki, that was completely undetected by major antivirus engines at the time of publication. The malware specifically targets Docker servers whose API endpoints are left publicly accessible — a misconfiguration common enough that attackers have built an ongoing automated campaign around it. Affected infrastructure includes cloud-hosted instances on AWS, Azure, and Alibaba Cloud.

What Is the Ngrok Mining Botnet Campaign?

The Doki malware is distributed as part of a broader campaign operated by the Ngrok mining botnet, which had already been active for approximately two years at the time of the Intezer disclosure. The campaign continuously scans the public internet for misconfigured Docker API endpoints. Once a vulnerable host is identified, attackers deploy malicious containers running cryptocurrency miners on the victim’s infrastructure — effectively stealing compute resources for profit.

What Makes Doki Unusual?

Doki stands out for several technical reasons beyond simply being a cryptominer dropper.

Blockchain-Based C2 Domain Generation

Rather than hardcoding command-and-control (C2) server addresses — which defenders can easily block — Doki uses a Domain Generation Algorithm (DGA) tied to the Dogecoin blockchain. It queries the Dogecoin block explorer in real time to derive the current C2 domain dynamically. Combined with the DynDNS service, this makes the C2 infrastructure extremely resilient: even if one domain is taken down, the algorithm generates a new one based on live blockchain data that only the attacker controls by spending Dogecoin.

Short-Lived Payload URLs

Doki crafts unique URLs with very short lifetimes to download payloads during an attack. This limits the window during which defenders or automated systems can retrieve and analyze the payload, complicating incident response and threat intelligence collection.

Cryptographic Network Communication

The malware uses the embedTLS library for encrypted network communication and cryptographic functions, helping it blend in with legitimate TLS traffic and resist inspection.

Evasion Track Record

According to Intezer’s findings, Doki was first uploaded to VirusTotal on January 14, 2020, and had been scanned multiple times since. Despite this, at the time of the July 2020 report it remained undetected by all 61 antivirus engines indexed on VirusTotal — a period of over six months of effective evasion.

Attack Chain: How Docker Hosts Are Compromised

The attack follows a clear progression once a misconfigured Docker API is found:

1. Discovery: The botnet scans the internet for Docker API endpoints that are publicly accessible without authentication.
2. Container deployment: Attackers use the exposed API to create a new malicious container, binding it to the host’s root filesystem (/) using Docker’s volume bind-mount feature.
3. Host escape: Because the container has access to the host’s root directory, the attacker can read and modify any file on the underlying machine — effectively escaping the container isolation boundary.
4. Persistence via cron: The attacker modifies the host machine’s cron configuration (accessible via the bind mount) to execute a downloaded payload every minute, ensuring persistence across container restarts.
5. Lateral scanning: Doki then uses network scanning tools — including zmap, zgrab, and jq — to scan for additional services on the network, specifically targeting ports associated with Redis, Docker, SSH, and HTTP, enabling further spread.

Why This Attack Is Particularly Dangerous

The combination of techniques makes this campaign more severe than a typical cryptojacking incident:

• Full host compromise: By binding containers to the host root, attackers gain capabilities far beyond what a contained environment should allow — including reading secrets, SSH keys, and modifying system binaries.
• Resilient C2: The blockchain-based DGA means that traditional domain blocklists and DNS sinkholes are ineffective against Doki.
• Multi-stage lateral movement: Active network scanning for Redis and SSH means a single compromised Docker host can become a pivot point into the broader internal network.
• Long undetected dwell time: Over six months of antivirus evasion means compromised systems may have been exfiltrating resources or data long before discovery.

Mitigation and Hardening Recommendations

The root cause of this attack is a misconfigured Docker daemon with its API exposed to the public internet. The following steps significantly reduce exposure:

1. Do Not Expose the Docker API to the Internet

By default, the Docker daemon listens on a Unix socket (/var/run/docker.sock), which is local-only. If you have configured Docker to listen on a TCP port (e.g., 2375 or 2376), restrict access using firewall rules so it is reachable only from known internal IP ranges or a VPN.

# Example: block public access to Docker API port with ufw
ufw deny 2375
ufw deny 2376Code language: PHP (php)

2. Use TLS Authentication for Remote API Access

If remote Docker API access is genuinely required, configure mutual TLS so that only clients with a valid certificate can connect. Docker’s documentation covers generating CA, server, and client certificates for this purpose.

3. Audit Bind Mounts

Avoid mounting the host root filesystem (/) or sensitive directories (e.g., /etc, /var/spool/cron) into containers. Review all docker run -v or Compose volumes: configurations for overly permissive mounts.

4. Implement Runtime Security Controls

Use runtime security tools (such as Falco, Sysdig, or similar) to detect anomalous behavior inside containers, such as cron modification, unexpected outbound connections, or cryptocurrency miner process signatures.

5. Validate API Parameters Carefully

If your application programmatically calls the Docker API to provision containers, rigorously validate all user-supplied parameters. An attacker who can influence API calls may be able to specify arbitrary bind mounts or privileged flags.

6. Apply Least-Privilege Principles

Run containers as non-root users where possible, use read-only root filesystems (--read-only), drop unnecessary Linux capabilities, and consider enabling user namespaces to limit the blast radius of a container escape.

Broader Context: Docker as a Recurring Attack Surface

The Doki disclosure was not an isolated event. In the same month (July 2020), separate malicious actors were reported targeting exposed Docker API endpoints to deploy images designed to conduct DDoS attacks and mine cryptocurrency. Exposed container APIs have been a consistent target for threat actors since at least 2018, making API access control one of the most critical security concerns for any team running Docker in a cloud environment.

Summary

The Doki malware represents a sophisticated evolution in cloud-targeting threats. Its use of a blockchain-based DGA for C2 resilience, combined with container escape via bind mounts and long antivirus evasion, makes it a serious risk for any organization with misconfigured Docker infrastructure. The defensive posture is straightforward: never expose the Docker daemon to the public internet, restrict access aggressively, audit container configurations for overly permissive mounts, and deploy runtime anomaly detection.