Using gRPC and HTTP/2 for Cryptominer Deployment: An Unconventional Approach

Threat actors are targeting Docker remote API servers to deploy SRBMiner crypto miners on compromised instances, according to Trend Micro. The attackers use the gRPC protocol via h2c to bypass security and manipulate Docker functionalities.