ShadowV2: How a New DDoS Botnet Mimics Cloud-Native Apps

ShadowV2 is a new DDoS botnet campaign described by researchers as merging traditional malware techniques with modern DevOps practices. According to Darktrace, it centres on a Python-based command-and-control framework hosted on GitHub CodeSpaces, with a Python-based spreader and a multi-stage Docker deployment as the initial access vector.

The operation also uses a Go-based RAT to deliver DDoS-as-a-service capabilities, and its design blends HTTP/2 rapid reset, a Cloudflare UAM bypass, and large-scale HTTP floods to combine DDoS techniques with targeted exploitation. ShadowV2 mimics the design of legitimate cloud-native applications, featuring FastAPI and a Pydantic-based OpenAPI specification, an operator login panel, and an admin/user privilege system that resemble a SaaS product.

It specifically targets Docker daemons running on AWS EC2 by abusing misconfigured instances with exposed Docker APIs, spawning containers on victim environments and imaging them for deployment. Inside the deployed container sits an unstripped Go binary that phones home via a RESTful API, with a VPS_ID derived from environment variables and polling for new commands.

The framework supports multi-tenant capabilities for customers, including authentication and role-based access, highlighting a professional, DDoS-for-hire orientation.