LemonDuck, a known cryptomining botnet, is currently engaged in an ongoing attack against Docker APIs on Linux servers. LemonDuck gains access through exposed Docker APIs and then runs a malicious container to download a Bash script disguised as a PNG file. Using a Linux cronjob, the payload downloads the Bash file which then goes on to kill processes of competing cryptomining groups and syslog daemons, delete known IOC file paths, stop command-and-control (C2) connections to competitors, and disable the Alibaba Cloud monitoring service. The removal of competing cryptomining groups and removing as many IOCs as possible is an excellent strategy to maximize available resources while also creating an environment to spend as much time as possible in before being discovered. After the system is reformatted, the cryptomining software XMRig is downloaded, and crypto mining begins. LemonDuck generally then attempts to continue lateral movement through SSH keys found in the infected device to further propagate throughout the network. Docker recommends following the best practices guidelines for secure Docker API setup along with setting resource consumption limits. Ankura will continue to monitor LemonDuck’s current campaign and any future campaigns that may come to light.