Kiss-a-Dog

Executive Summary

Kiss-a-Dog is a threat actor linked to a cryptojacking campaign targeting vulnerable Docker and Kubernetes infrastructure. The actor exploits container vulnerabilities and uses obscure domains and anonymized mining pools to evade detection. This campaign highlights risks to cloud-native environments and underscores the need for robust container security measures.

Goals & Targeting

Kiss-a-Dog's primary objective appears to be financial gain through cryptocurrency mining. The actor specifically targets sectors heavily reliant on containerized infrastructure, such as cloud services, DevOps, and software development, where vulnerabilities in Docker and Kubernetes configurations are prevalent. By exploiting these environments, the group can leverage the computational resources of victim systems to mine cryptocurrency without direct interaction from victims. The lack of known geopolitical motives suggests a criminally motivated approach focused on monetizing infrastructure weaknesses.

CrowdStrike identified the 'Kiss-a-Dog' campaign, a cryptojacking operation that exploits misconfigured or vulnerable Docker and Kubernetes deployments. The threat actor leverages container escape techniques to gain access to host systems, then deploys cryptocurrency mining payloads. A key indicator is the use of an obscure domain within the payload, suggesting an effort to avoid detection by security tools. Anonymized mining pools with 'dog' in their names are used to obscure the actor's infrastructure. The campaign highlights a growing trend of adversaries targeting cloud-native technologies, where misconfigurations and unpatched vulnerabilities are common. The use of container-based infrastructure as a vector underscores the need for stricter security controls in DevOps environments.

Key Capabilities

• Container escape exploits
• Exploitation of Docker/Kubernetes vulnerabilities
• Use of obscure, anonymized domains for command-and-control (C2)
• Deployment of cryptocurrency mining payloads
• Obfuscation of infrastructure via anonymized mining pools

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Kiss-a-Dog's campaigns are characterized by a focus on containerized infrastructure, leveraging misconfigurations and unpatched vulnerabilities in Docker and Kubernetes environments. The actor's use of obscure domains and anonymized pools suggests an effort to operate covertly and avoid attribution. Operational tempo appears to be low-and-slow, prioritizing stealth over rapid lateral movement. Notably, no prior campaigns or actor affiliations have been publicly attributed to this group, indicating it may be an emerging threat.

IOC Patterns

• Spear-phishing with malicious Office documents targeting DevOps personnel
• C2 communication over DNS with fast-flux infrastructure
• Staging of infrastructure on bulletproof hosting services
• Use of mining pools with names containing 'dog' (e.g., 'dog-pool.com')

Recommended Actions

• Audit and patch Docker/Kubernetes configurations to prevent container escape
• Implement network segmentation to isolate container hosts from critical infrastructure
• Monitor for anomalous CPU usage patterns indicative of cryptojacking
• Deploy endpoint detection tools with container-specific threat signatures
• Blocking domains associated with anonymized mining pools in network firewalls

Suggested Tags