ATT&CK technique

T1552.001

2 campaigns

TeamPCP v21: Inside a 45-Second Docker Escape to Multi-Persistence Cryptojacking

Docker exposes a management interface, the Docker daemon API, that lets you create, start, and control containers. When it is accidentally published to the internet with no authentication, anyone who can reach that port can take over the host underneath it. We watched a fully automated toolkit do exactly that in about 45 seconds.

2026-06-29

FortiGate Admin-Hijack Operator Plants Hidden Backdoors and Steals Full Device Configuration

A skilled operator used CVE-2022-40684 to take over an internet-facing FortiGate through its REST API: six backdoor super-admin accounts, an SSH key for re-entry, the admin account hidden from the GUI, MFA disabled, and the full configuration stolen. No malware.

2026-06-09