Daemon in the Dark

A Linux Docker host quietly started mining crypto overnight. Its container-engine API was open to the internet, and an automated intruder used it to launch a host-mounting container, drop the Kinsing malware and an XMRig miner, kill the defenses, and try to spread. Work the host, perimeter, and cloud trails to reconstruct the intrusion.