Attackers deploying new tactics in campaign targeting exposed Docker APIs

The attackers behind Spinning YARN have launched a new cryptojacking campaign targeting publicly exposed Docker Engine hosts. They introduced two novel binary payloads, chkstart and exeremo, to propagate the malware via SSH and dynamically execute payloads. The attackers also modified existing systemd services using the ExecStartPost configuration option for persistence.