Docker Hub Cryptojacking: Malicious XMRig Image Mining Monero

A platform engineer pulls a public Docker Hub image disguised as a network scanning utility to a shared build-runner. Instead of scanning, the image clones the public xmrig repository, runs a shell launcher, and starts the XMRig miner against the hashvault Monero pool for an attacker wallet, pinning the host CPU for hours and failing over to a second pool when throttled. Reconstruct the cryptojacking chain from endpoint XDR and perimeter firewall telemetry, and classify the key ATT&CK techniques.