New Malware Campaign Exploits Docker Environments with Deep Obfuscation to Fuel Cryptojacking
A newly uncovered malware operation is targeting Docker environments, using an elaborate multi-layered obfuscation technique to bypass detection and hijack computing resources for cryptocurrency rewards.
Researchers at Darktrace and Cado Security Labs analyzed the campaign, revealing not only the technical creativity behind the attack but also the increasing risks faced by containerized infrastructures.
Why Docker Has Become a High-Value Target
As the most widely adopted containerization platform, Docker has become a favored target for cybercriminals. Its open ecosystem and the ease of deploying public container images create an attractive landscape for attackers.
Misconfigured or exposed Docker services are often exploited to run malicious containers pulled directly from Docker Hub.
In this case, the attack chain starts by launching a container from Docker Hub — specifically using the kazutod/tene:ten image.
Embedded within the image layers is a Python script (ten.py), hidden behind an intricate obfuscation mechanism that analysts were able to uncover using Docker’s own tools.
Inside the Obfuscation Maze
The obfuscation method used in this campaign is unusually complex:
- The
ten.pyscript creates a lambda function that reverses a base64-encoded string, decodes it, decompresses it with zlib, and then executes the resulting code. - This decoding process recursively repeats — each decoded payload contains another obfuscated string for the next decoding stage.
- It took 63 recursive decoding iterations before the actual malicious payload was finally revealed.
Such a deep layering of obfuscation is rare. While a single layer is often enough to evade basic detection systems, dozens of layers appear specifically designed to frustrate analysts and defeat automated scanning tools.
Nevertheless, researchers successfully automated the unraveling process, extracting the final payload in just a few minutes.
A New Breed of Cryptojacking
Instead of deploying traditional crypto miners like XMRig, this malware uses a far subtler monetization strategy.
After de-obfuscation, the malware connects to teneo.pro, a legitimate Web3 platform that powers a decentralized social media data network.
By pretending to operate a legitimate node and sending constant “keep-alive” signals, the infected containers earn Teneo Points — private cryptocurrency tokens awarded for uptime and participation.
Interestingly, the malware does not engage in legitimate data gathering or interaction — it simply fakes activity to maximize token rewards, avoiding the high CPU load and network anomalies that typically expose cryptojacking operations.
Because Teneo Points are private and not easily traced, estimating the attacker’s total earnings remains difficult.
Key Takeaways and Defense Strategies
This campaign reflects a larger shift in the threat landscape:
Attackers are moving away from traditional, easily detected mining malware to abuse legitimate decentralized platforms and reward systems.
To protect Docker environments, security experts strongly recommend:
- Restricting Docker service exposure to the internet wherever possible.
- Enforcing strong authentication and firewall policies.
- Continuously monitoring and auditing container activity for anomalies.
- Pulling container images only from trusted, verified sources and scanning them before deployment.
As adversaries continue to innovate, defensive strategies must evolve to stay ahead of increasingly stealthy and sophisticated threats targeting containerized infrastructure.
