ShadowV2: An emerging DDoS for hire botnet

According to Darktrace, ShadowV2 is a DDoS-for-hire platform that combines a Python-based C2 framework hosted on GitHub Codespaces with a Go-based RAT and a multi-stage Docker deployment, all wrapped in a full operator UI and a modular API. The malware spawns a wrapper container that runs an ELF binary in Go and uses an HTTP/2-based rapid reset attack, with capabilities to perform large-scale HTTP floods and to bypass Cloudflare under-attack-mode using a bundled ChromeDP binary.

It exposes an OpenAPI specification and a login panel, suggesting a multi-tenant DDoS platform with admin and user distinctions and an attack-start endpoint that requires a list of zombie systems. In the observed operations, the implant reports to a C2 at shadow.aurozacloud[.]xyz, sending heartbeats every second and polling every five seconds for new commands.

The campaign also leverages a RESTful registration mechanism, a Go-based RAT, and various bypass flags such as HTTP2 rapid reset and UAM bypass, underscoring a shift toward cloud-native, service-like threat tooling. ShadowV2 underscores the need for monitoring containerised workloads, cloud API activity, and orchestration patterns to defend against evolving cybercrime-as-a-service platforms.