ShadowV2 DDoS Service Lets Customers Self-Manage Attacks

ShadowV2 is a DDoS botnet that subdivides the traditional model by letting customers self-manage attacks through access to an infected Docker container network. The operators use a Python-based C&C platform hosted on GitHub CodeSpaces, with infection chains starting from a Python script that interacts with Docker to create containers and target internet-accessible Docker daemons on AWS.

Instead of pushing pre-made images, they spin up a generic setup container, then deploy tools inside it, create a new image, and run it as a live container. The wrapper container hosts a Go-based binary that delivers HTTP flood campaigns, while the malware incorporates bypass techniques such as HTTP2 rapid reset, spoofed forwarding headers with random IPs, and Cloudflare under-attack-mode.

The C&C is protected by Cloudflare, and researchers believe the API-driven endpoint structure converts the botnet into a platform with a customer-facing interface, including authentication and limits on attack types. ShadowV2 is described as a DDoS-as-a-service platform rather than a traditional botnet, with emphasis on modular upgrades and potential abuse of legitimate cloud services. 23 September 2025.