Loading story…
The Overlord project was published on GitHub as a self-hosted remote administration platform combining a TypeScript server, Go client, web panel, Electron desktop application, and agents that communicate over encrypted WebSockets. Its documentation describes cross-platform deployment for Linux, Windows, and macOS, along with remote desktop features that support Canvas rendering, WebRTC peer-to-peer sessions, and relayed WebRTC using bundled Coturn and MediaMTX services.
The project’s setup guidance emphasizes Docker-based deployment on Linux while recommending native bare-metal installation on Windows instead of Docker Desktop, and it aligns with broader Docker installation requirements for macOS such as separate Apple silicon and Intel installers, at least 4 GB of RAM, and optional command-line installation and proxy settings. Overlord also includes enterprise-oriented features such as OIDC single sign-on, TLS and reverse-proxy support, branding controls, runtime client building, and network configuration requirements for TURN and WebRTC connectivity.
Get the actors, campaigns, and ATT&CK mapping behind it.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have been abusing improperly exposed Docker daemon APIs, especially unauthenticated services on port `2375`, to take control of running containers and deploy malware. One documented campaign used the Dofloo (AESDDoS) Trojan to enumerate containers and run malicious payloads with Docker commands, giving operators DDoS capability, host profiling data, and a foothold for follow-on activity such as cryptojacking or broader system compromise. Public tooling has also lowered the barrier to exploiting these weaknesses. The **BOtB** container assessment tool demonstrates how exposed Docker daemons, privileged container configurations, Kubernetes service account exposure, metadata service access, Linux kernel keyring leakage, and even `runc` escape flaw `CVE-2019-5736` can be used to break out of containers or extract secrets in CI/CD and live environments. Docker’s guidance recommends protecting the daemon socket and restricting remote API access to trusted systems, underscoring that exposed or misconfigured container management interfaces can quickly turn a single container issue into host-level compromise.
Aug 15, 2026
Researchers uncovered **Auraboros C2**, a previously undocumented Brazilian remote access trojan framework whose management panel at `174.138.43[.]25:5000` was exposed on the public internet **without authentication**. The HTTP-based Express.js and Socket.io dashboard, hosted on DigitalOcean and written in Brazilian Portuguese, allowed anyone with network access to view victim metadata, command history, keylogs, browser credential theft results, and real-time operator activity. Investigators said the platform supports extensive surveillance and post-compromise actions, including screenshots, webcam capture, **live audio streaming**, Wi-Fi password extraction, file operations, shell execution, reverse SOCKS5 proxying, and over-the-air malware updates. Analysis indicated the Windows implant likely used **DLL sideloading** via `DiskIntegrityScanner.exe`, decrypted Chrome and Brave credentials with **Windows DPAPI**, and included a cookie impersonation capability alongside a self-destruct function. Despite the broad feature set, researchers found only one registered beacon tied to a Lenovo laptop in Goiânia, Brazil, suggesting the infrastructure was still in development or testing rather than large-scale deployment. The exposed server also listened on ports `1080` and `9000`, believed to support reverse SOCKS5 and beacon or stager traffic, and the operator was assessed as a Brazilian Portuguese-speaking developer whose poor operational security left the entire framework and test telemetry publicly accessible.
Jun 29, 2026