Loading story…
Akamai researchers have identified a new malware variant targeting exposed Docker APIs, evolving from cryptojacking to botnet-building. The malware blocks external access to Docker APIs, installs persistence mechanisms, and propagates itself to other vulnerable systems. It also contains dormant code for Telnet and Chrome debugging port exploitation, indicating potential for future credential theft and DDoS attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcebleepingcomputer.com
Open sourcethehackernews.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers abused misconfigured Docker Engine instances that exposed the unauthenticated Docker API on port `2375`, using it to enumerate running containers and execute malware inside them. Trend Micro reported that the campaign leveraged `docker exec` to deploy an AESDDoS payload detected as **Backdoor.Linux.DOFLOO.AA**, giving operators the ability to run distributed denial-of-service attacks from compromised container environments. The activity relied on scanning IP ranges for hosts with port `2375` open and using a toolkit distributed in a ZIP archive named `2375-SYNG口漏洞.zip`, which included utilities such as **WinEggDrop** and a **Docker Batch Test Tool** to find and exploit vulnerable systems. Researchers warned that exposing the Docker daemon in this way can effectively grant root-level control of the host, and noted that the AESDDoS variant has also been linked to remote code execution and cryptocurrency-mining activity.
Aug 14, 2026
Attackers have been abusing improperly exposed Docker daemon APIs, especially unauthenticated services on port `2375`, to take control of running containers and deploy malware. One documented campaign used the Dofloo (AESDDoS) Trojan to enumerate containers and run malicious payloads with Docker commands, giving operators DDoS capability, host profiling data, and a foothold for follow-on activity such as cryptojacking or broader system compromise. Public tooling has also lowered the barrier to exploiting these weaknesses. The **BOtB** container assessment tool demonstrates how exposed Docker daemons, privileged container configurations, Kubernetes service account exposure, metadata service access, Linux kernel keyring leakage, and even `runc` escape flaw `CVE-2019-5736` can be used to break out of containers or extract secrets in CI/CD and live environments. Docker’s guidance recommends protecting the daemon socket and restricting remote API access to trusted systems, underscoring that exposed or misconfigured container management interfaces can quickly turn a single container issue into host-level compromise.
Aug 15, 2026
The newly identified **Carbonato** botnet compromises Docker daemon APIs exposed without authentication on TCP port `2375`. It deploys privileged containers to gain host-level execution, creates reverse SSH access, installs persistence through multiple Linux startup mechanisms, and propagates by scanning connected `/24` networks every five minutes for additional reachable Docker APIs. Researchers found evidence of the operation spanning October 2024 through August 2026, including an exposed registry containing 59 repositories, 234 image tags, 605 verified blobs, and 4.3 GB of images. Carbonato installs the legitimate Hermes Agent framework but modifies its `SOUL.md` persona to create an agent called **GH0ST**, which receives tasks through Telegram. The agent can collect credentials—including AI API keys—execute commands, and exfiltrate results, while Telegram also provides operator reporting on deployments. Researchers have not attributed the activity to a known threat group; linguistic, infrastructure, configuration, and Telegram-handle evidence suggests a possible Costa Rica link but remains inconclusive.
Sep 24, 2026