Exposed Docker Daemons Fuel DDoS Botnet

A new DDoS-for-hire botnet, dubbed ShadowV2 by researchers at Darktrace, is exploiting misconfigured Docker environments to weaponise cloud-native tools for attack campaigns. The campaign targets Internet-exposed Docker daemons on AWS EC2, with Censys data noting that the Docker daemon listens on port 2375 and that about 24,000 IP addresses have this port open.

ShadowV2 operators deploy a generic setup container on the victim’s Docker server, install their malware within it, and then launch attacks from a live container, using a Python script via GitHub Codespaces to manage deployment and configuration. The malware communicates with a C2 server, sends heartbeat signals every second, and polls for commands every five seconds, with capabilities including HTTP/2 rapid resets, large-scale HTTP floods, and a Cloudflare UAM bypass.

According to Darktrace, the attackers’ use of a containerised, API-driven interface and cloud-native orchestration highlights how DDoS-for-hire services are being industrialised; defenders are urged to enforce least privilege, disable exposed Docker APIs, and implement strong authentication across containers and orchestration tools.