Loading story…
Attackers have been abusing improperly exposed Docker daemon APIs, especially unauthenticated services on port 2375, to take control of running containers and deploy malware. One documented campaign used the Dofloo (AESDDoS) Trojan to enumerate containers and run malicious payloads with Docker commands, giving operators DDoS capability, host profiling data, and a foothold for follow-on activity such as cryptojacking or broader system compromise.
Public tooling has also lowered the barrier to exploiting these weaknesses. The BOtB container assessment tool demonstrates how exposed Docker daemons, privileged container configurations, Kubernetes service account exposure, metadata service access, Linux kernel keyring leakage, and even runc escape flaw CVE-2019-5736 can be used to break out of containers or extract secrets in CI/CD and live environments. Docker’s guidance recommends protecting the daemon socket and restricting remote API access to trusted systems, underscoring that exposed or misconfigured container management interfaces can quickly turn a single container issue into host-level compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
A GitHub repository documents BOtB (Break Out The Box), a CLI tool for container analysis and exploitation that includes checks and exploitation paths for exposed Docker daemons, privileged containers, Kubernetes secrets, metadata services, keyrings, and CVE-2019-5736.
A previous campaign in late April used a critical Atlassian Confluence Server and Data Center server-side template injection vulnerability to deploy Dofloo on Linux and Windows servers.
In March, Imperva detected a campaign that abused exposed Docker APIs while exploiting CVE-2019-5736 in runc to gain root-level code execution on hosts.
Juniper Networks researchers observed attacks against misconfigured Docker services in which attackers added their own containers to run Monero mining scripts.
Researchers also observed a separate campaign in October 2018 that scanned for exposed Docker hosts and deployed coin-mining malware.
The article states that campaigns scanning for exposed Docker services and deploying cryptocurrency miners were already active in March 2018.
Misconfigured Docker services had been under sustained attack since early 2018, according to the reporting cited in the article.
The Dofloo malware family, also known as AESDDoS, was first detected in 2014 and later became associated with large-scale botnet activity.
Trend Micro observed attackers scanning TCP port 2375 for exposed Docker APIs, enumerating running containers, and using docker exec to deploy a Dofloo Trojan variant for DDoS and follow-on compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
docs.docker.com
Open sourcegithub.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported that attackers are actively targeting **unsecured Docker daemons** exposed to the internet, using the Docker API to create and run malicious containers on victim systems. By abusing misconfigured deployments that lack proper access controls, intruders can gain effective control of the underlying host, execute arbitrary workloads, and use compromised infrastructure for follow-on activity such as cryptomining, persistence, and broader cloud or network compromise. The report details attacker tradecraft focused on exposed container management interfaces, where adversaries issue Docker commands remotely to pull attacker-controlled images and launch privileged containers that can interact with the host environment. The activity highlights a recurring cloud security risk: organizations that leave Docker services reachable without authentication can enable rapid compromise of containerized environments and the systems that support them.
Jul 12, 2026
Attackers abused misconfigured Docker Engine instances that exposed the unauthenticated Docker API on port `2375`, using it to enumerate running containers and execute malware inside them. Trend Micro reported that the campaign leveraged `docker exec` to deploy an AESDDoS payload detected as **Backdoor.Linux.DOFLOO.AA**, giving operators the ability to run distributed denial-of-service attacks from compromised container environments. The activity relied on scanning IP ranges for hosts with port `2375` open and using a toolkit distributed in a ZIP archive named `2375-SYNG口漏洞.zip`, which included utilities such as **WinEggDrop** and a **Docker Batch Test Tool** to find and exploit vulnerable systems. Researchers warned that exposing the Docker daemon in this way can effectively grant root-level control of the host, and noted that the AESDDoS variant has also been linked to remote code execution and cryptocurrency-mining activity.
Aug 14, 2026
Docker disclosed a high-severity Docker Engine vulnerability, **CVE-2026-34040** (`CVSS 8.8`), that allows attackers to bypass authorization plugins and perform actions that should be blocked. The flaw stems from an incomplete fix for **CVE-2024-41110** and is triggered when a specially crafted oversized Docker API request causes the request body to be dropped before inspection by an AuthZ plugin. In affected environments, the plugin may approve container operations it would otherwise deny, opening a path to unauthorized privileged actions and potential host compromise. Researchers said an attacker with Docker API access could exploit the bug by padding a container-creation request beyond **1 MB** to launch a privileged container with access to the host filesystem, exposing sensitive assets such as **AWS credentials**, **SSH keys**, and **Kubernetes configurations**. The issue affects deployments that rely on authorization plugins inspecting request bodies, while environments not using those plugins are not impacted. Docker patched the vulnerability in **Docker Engine 29.3.1** and urged defenders to upgrade, restrict Docker API access, avoid AuthZ plugins that depend on request-body inspection, and use controls such as rootless mode, user namespace remapping, and least-privilege access to reduce risk.
Jul 23, 2026