Attackers Deploying New Tactics in Campaign Targeting Exposed Docker APIs

The attackers utilize new binaries, including chkstart, exeremo, and vurld, along with a persistence mechanism that modifies systemd services. Analysis suggests a link between this campaign and Spinning YARN.