Loading story…
Researchers have identified the ShadowV2 botnet, which exploits misconfigured Docker containers on AWS to deploy Go-based malware and conscript systems into a DDoS-for-hire network. The campaign uses a sophisticated Python-based C2 framework, advanced DDoS techniques like HTTP/2 Rapid Reset, and attempts to bypass Cloudflare's Under Attack mode. The infrastructure is designed for modularity and operator control, highlighting the evolution of cybercrime-as-a-service.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Darktrace publicly reported the ShadowV2 campaign, detailing its abuse of exposed Docker daemons and cloud-native tooling to build a DDoS botnet. The company also noted that the botnet domain displayed a seizure notice on its root page while still exposing a functional login panel, suggesting the seizure page was deceptive and the backend remained active.
Darktrace emulated the implant and observed it receiving commands and initiating an HTTP/2 rapid reset attack against a target domain hosted by an Amsterdam VPS provider. The analysis also documented evasion features including randomized query strings, spoofed forwarding headers, and a Cloudflare clearance-cookie bypass using ChromeDP.
After compromise, ShadowV2 dropped an unstripped Go ELF binary that registered with a RESTful command-and-control server, maintained heartbeat and polling loops, and accepted attack tasks. Researchers found the infrastructure resembled a multi-tenant DDoS-as-a-service platform with authentication, roles, attack limits, and support for HTTP flood and HTTP/2 rapid reset attacks.
Operators of the ShadowV2 botnet used a Python spreader hosted on GitHub CodeSpaces and the Python Docker SDK to target externally accessible Docker APIs, primarily on AWS EC2 systems. The malware created customized containers on victim infrastructure to establish initial access and deploy the botnet implant.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcescworld.com
Open sourcedarktrace.com
Open sourcedarkreading.com
Open sourceisc.sans.edu
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused misconfigured Docker Engine instances that exposed the unauthenticated Docker API on port `2375`, using it to enumerate running containers and execute malware inside them. Trend Micro reported that the campaign leveraged `docker exec` to deploy an AESDDoS payload detected as **Backdoor.Linux.DOFLOO.AA**, giving operators the ability to run distributed denial-of-service attacks from compromised container environments. The activity relied on scanning IP ranges for hosts with port `2375` open and using a toolkit distributed in a ZIP archive named `2375-SYNG口漏洞.zip`, which included utilities such as **WinEggDrop** and a **Docker Batch Test Tool** to find and exploit vulnerable systems. Researchers warned that exposing the Docker daemon in this way can effectively grant root-level control of the host, and noted that the AESDDoS variant has also been linked to remote code execution and cryptocurrency-mining activity.
Aug 14, 2026
A new Mirai-based botnet variant named **ShadowV2** was observed exploiting a major AWS outage in October to infect IoT devices across 28 countries. Security researchers at Fortinet’s FortiGuard Labs reported that ShadowV2 leveraged at least eight known vulnerabilities in devices from vendors such as D-Link, TP-Link, DD-WRT, DigiEver, and TBK. The botnet propagated rapidly during the day-long AWS disruption, targeting routers, NAS devices, and DVRs in sectors including government, technology, manufacturing, telecommunications, education, and managed security service providers. The attackers used a downloader script (`binary.sh`) to deliver the malware, which then connected to command-and-control infrastructure to receive further instructions. The campaign appeared to be a test run, as the botnet was only active during the AWS outage and did not persist beyond that period. Notably, some of the exploited vulnerabilities, such as `CVE-2024-10914` and `CVE-2024-10915`, affect end-of-life D-Link devices for which no patches are available, leaving many systems permanently exposed. D-Link updated its advisories to warn users about the risks to unsupported devices, while TP-Link addressed one of the flaws with a beta firmware update. The ShadowV2 botnet’s global reach and ability to exploit multiple unpatched IoT vulnerabilities highlight the ongoing risks posed by insecure and unsupported connected devices, especially during periods of widespread internet infrastructure disruption.
Jun 29, 2026Akamai researchers have identified a new malware variant targeting exposed Docker APIs, evolving from cryptojacking to botnet-building. The malware blocks external access to Docker APIs, installs persistence mechanisms, and propagates itself to other vulnerable systems. It also contains dormant code for Telnet and Chrome debugging port exploitation, indicating potential for future credential theft and DDoS attacks.
Jun 29, 2026