Commando Cat

Commando Cat is a threat actor, or malicious entity, that has been identified as the force behind an attack campaign exploiting exposed Docker remote API servers. This campaign is notable due to its unique initial step, which involves deploying harmless containers using the open-source GitHub project known as Commando. The name "Commando Cat" was coined because of this initial step, and the campaign has been analyzed in depth by cybersecurity experts at Cado Security. The Commando Cat campaign specifically targets Docker's API endpoints, according to findings released by Cado researchers. The attack sequence involves leveraging Docker as an initial access point, then abusing the service to mount the host's filesystem. Following this, a series of interdependent payloads are run directly on the host. The campaign is primarily a cryptojacking operation, which illicitly uses the victim's computing resources to mine cryptocurrency. The identity and origin of the threat actor behind Commando Cat remain unclear. There have been overlaps noted in the scripts used and IP addresses between Commando Cat and other threat groups such as Team TNT. This could suggest a potential connection or simply indicate that Commando Cat is imitating these other groups. Regardless, the existence and activities of Commando Cat underscore the ongoing risks associated with exposed Docker remote API servers and the broader challenges of maintaining secure digital environments.