---
id: 7156
title: "Pause off my cluster: DERO cryptojacking takes a new shape"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/dero-cryptojacking-campaign-adapts-to-evade-detection"
published_at: "2024-06-07T12:04:51Z"
tags: ["cloud-security", "kubernetes", "container-security", "threat-research", "cryptojacking", "dero"]
phying_url: "https://phying.com/item/7156"
lang: en
---

# Pause off my cluster: DERO cryptojacking takes a new shape

## Summary

Wiz Research details an evolved DERO cryptojacking campaign abusing anonymous-access Kubernetes clusters to deploy UPX-packed miners from Docker Hub images, plus updated TTPs and IoCs.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2024-06-07T12:04:51Z
- **Original:** https://www.wiz.io/blog/dero-cryptojacking-campaign-adapts-to-evade-detection
- **Phying News:** https://phying.com/item/7156