Attackers are exploiting Docker Engine deployments that are exposed to the internet without authentication to deploy and run cryptojacking malware on servers. A new cryptojacking botnet with self-spreading capabilities has infected over 2,000 such Docker deployments so far.

“There have been incidents of cryptojacking malware spreading as a worm, but this is the first time we see a cryptojacking worm spread using containers in the Docker Engine (Community Edition),” researchers from Palo Alto Networks said in a report released today. “Because most traditional endpoint protection software does not inspect data and activities inside containers, this type of malicious activity can be difficult to detect.”