{"id":26700,"date":"2020-07-31T14:18:55","date_gmt":"2020-07-31T11:18:55","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=26700"},"modified":"2025-08-26T16:01:16","modified_gmt":"2025-08-26T13:01:16","slug":"malware-used-the-dogecoin-blockchain-to-covertly-mine-cryptocurrency","status":"publish","type":"post","link":"https:\/\/u1f987.com\/en\/malware-used-the-dogecoin-blockchain-to-covertly-mine-cryptocurrency\/","title":{"rendered":"Malware used the Dogecoin blockchain to covertly mine cryptocurrency"},"content":{"rendered":"<p><span style=\\\"font-weight: 400;\\\">Attackers developed malware that uses the <\/span><span style=\\\"font-weight: 400;\\\">Dogecoin<\/span><span style=\\\"font-weight: 400;\\\"> blockchain to attack cloud servers and subsequently mine cryptocurrency covertly. Intezer researchers report.<\/span><!--more--><\/p>\n<blockquote class=\\\"twitter-tweet\\\">\n<p dir=\\\"ltr\\\" lang=\\\"en\\\">Intezer Protect detected advanced Doki malware infecting Docker cloud servers. Read the full article here: <a href=\\\"https:\/\/t.co\/1q3Oi0l4D2\\\">https:\/\/t.co\/1q3Oi0l4D2<\/a><\/p>\n<p>Demo the platform at <a href=\\\"https:\/\/twitter.com\/hashtag\/BHUSA?src=hash&#038;ref_src=twsrc%5Etfw\\\">#BHUSA<\/a> <a href=\\\"https:\/\/t.co\/8CQ1KzJLtd\\\">https:\/\/t.co\/8CQ1KzJLtd<\/a> <a href=\\\"https:\/\/t.co\/DYt7jCYG2U\\\">pic.twitter.com\/DYt7jCYG2U<\/a><\/p>\n<p>\u2014 Intezer (@IntezerLabs) <a href=\\\"https:\/\/twitter.com\/IntezerLabs\/status\/1288871331312828418?ref_src=twsrc%5Etfw\\\">July 30, 2020<\/a><\/p>\n<\/blockquote>\n<p><script async src=\\\"https:\/\/platform.twitter.com\/widgets.js\\\" charset=\\\"utf-8\\\"><\/script><\/p>\n<p>Hackers installed the Doki backdoor on Docker servers running Linux. The malware was deployed via a botnet named Ngrok. Doki used the Dogecoin blockchain to create a C2 domain.<\/p>\n<p>The attackers could control the address the malware would contact by transferring a certain amount of Dogecoin from their wallet, Intezer noted.<\/p>\n<p>Using the Dogecoin blockchain made the malware highly resilient to actions by law enforcement and cybersecurity firms. This helped Doki remain undetected for more than six months.<\/p>\n<p>Security researchers warned that such an attack is very dangerous:<\/p>\n<blockquote>\n<p>\u201cFor infection, only a few hours are required from the moment a newly misconfigured Docker server connects to the network.\u201d<\/p>\n<\/blockquote>\n<p><span style=\\\"font-weight: 400;\\\">Earlier Cisco Talos researchers identified a botnet that allowed the use of users&apos; computer systems to mine Monero.<\/span><\/p>\n<p>Subscribe to ForkLog news on Telegram: <a href=\\\"https:\/\/t.me\/forklogfeed\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">ForkLog Feed<\/a> \u2014 the full news feed, <a href=\\\"https:\/\/telegram.me\/forklog\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">ForkLog<\/a> \u2014 the most important news and polls.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attackers developed malware that uses the Dogecoin blockchain to attack cloud servers and subsequently mine cryptocurrency covertly. Intezer researchers report.<\/p>\n","protected":false},"author":1,"featured_media":26216,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1154,99],"class_list":["post-26700","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-crimes","tag-dogecoin"],"aioseo_notices":[],"amp_enabled":true,"views":"","promo_type":"1","layout_type":"","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/26700","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/comments?post=26700"}],"version-history":[{"count":1,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/26700\/revisions"}],"predecessor-version":[{"id":26701,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/posts\/26700\/revisions\/26701"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media\/26216"}],"wp:attachment":[{"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/media?parent=26700"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/categories?post=26700"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/u1f987.com\/en\/wp-json\/wp\/v2\/tags?post=26700"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}