Attackers Target Exposed Docker Remote API Servers With perfctl Malware

The attack sequence starts with probing the Docker Remote API server by pinging it, creating a container with specific settings, and executing payloads using the Docker Exec API.