Loading story…
Researchers reported that Kaiji and XORDDoS operators were actively compromising Linux infrastructure to expand botnets used for distributed denial-of-service attacks. Trend Micro observed both malware families targeting exposed Docker servers through the unauthenticated Docker API on port 2375: XORDDoS enumerated running containers on vulnerable hosts and executed commands inside each one to download and launch its payload, while Kaiji scanned for exposed Docker instances, validated targets, and deployed a rogue ARM container that fetched and ran the malware. The activity showed two distinct propagation models aimed at the same weakly secured container environments.
Separate analysis of Kaiji found the malware was a Golang-based Linux and IoT botnet with assessed Chinese origins, built from scratch rather than derived from Mirai or BillGates. Researchers said Kaiji also spread through SSH brute forcing, targeted the root account, installed itself under disguised filenames, and supported DDoS functions, shell command execution, C2 replacement, self-deletion, and Linux persistence. It also attempted lateral movement by abusing local SSH keys and IP addresses recovered from bash history and known-hosts data, although researchers assessed the operation as relatively immature because its infrastructure was short-lived and parts of the code appeared unfinished.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers identified a new botnet campaign named Kaiji in late April, assessing it as a Linux server and IoT botnet with definitive Chinese origins that spreads via SSH brute forcing. The malware was described as written from scratch in Golang rather than derived from Mirai or BillGates.
Trend Micro reported new variants of both XORDDoS and Kaiji targeting internet-exposed Docker API port 2375. In the observed activity, XORDDoS infected existing containers by executing commands in each one, while Kaiji deployed a rogue ARM container to download and run its payload.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
intezer.com
Open sourceblog.trendmicro.com
Open sourceintezer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
Threat actors abused exposed Docker servers by creating a malicious Alpine Linux container that launched a multi-stage infection chain, ultimately installing both a cryptocurrency miner and an IRC-based DDoS bot. The attack used a Bash script named `XMI` and a Python script named `d.py` to download payloads, establish persistence, and spread further, with the miner identified as **Coinminer.Linux.MALXMR.UWELD** and the bot as a Kaiten/Tsunami variant detected as **Backdoor.Linux.KAITEN.AMV**. The malware relied on Base64 obfuscation, cron jobs, and a service placed in `/etc/init.d` for persistence, and it attempted lateral movement by harvesting targets from `/.ssh/known_hosts`; researchers also found commented-out SSH brute-force propagation code. Trend Micro said the miner wallet overlapped with earlier campaigns exploiting `CVE-2019-3396` and `CVE-2017-5638`, previously associated in public reporting with the **8220** mining group, while the DDoS component communicated with command-and-control infrastructure including `c4k[.]xpl[.]pwndns[.]pw`, `104[.]244[.]75[.]25`, and `107[.]189[.]11[.]170`.
Aug 14, 2026
Attackers abused misconfigured Docker Engine instances that exposed the unauthenticated Docker API on port `2375`, using it to enumerate running containers and execute malware inside them. Trend Micro reported that the campaign leveraged `docker exec` to deploy an AESDDoS payload detected as **Backdoor.Linux.DOFLOO.AA**, giving operators the ability to run distributed denial-of-service attacks from compromised container environments. The activity relied on scanning IP ranges for hosts with port `2375` open and using a toolkit distributed in a ZIP archive named `2375-SYNG口漏洞.zip`, which included utilities such as **WinEggDrop** and a **Docker Batch Test Tool** to find and exploit vulnerable systems. Researchers warned that exposing the Docker daemon in this way can effectively grant root-level control of the host, and noted that the AESDDoS variant has also been linked to remote code execution and cryptocurrency-mining activity.
Aug 14, 2026