Trend Micro researchers have detected a campaign in which compromised docker hosts use Shodan for carrying out cryptocurrency mining. Hackers scan for Docker hosts with exposed APIs and use them for cryptocurrency mining, which is done by deploying malicious self-propagating Docker images that are infected with Monero miners. Researchers at Trend Micro discovered this campaign after a Docker image that contained a Monero (XMR) cryptocurrency miner binary was deployed on one of their honeypots, set up as part of their efforts to monitor malicious activity aimed at containers.”]
Source: https://hackercombat.com/compromised-docker-hosts-use-shodan-for-cryptocurrency-mining/