ShadowV2 Botnet Infects AWS Docker Containers to Launch DDoS Campaign

ShadowV2 is described as a botnet-as-a-service campaign that infects AWS Docker containers to power a DDoS operation. Darktrace’s latest investigation identifies a Python-based C2 framework hosted on GitHub Codespaces, paired with a Go-based RAT that handles registration and polling via a RESTful API.

The abuse unfolds through a multi-stage Docker deployment: a Python spreader initiates the process, followed by the RAT, with the malware ultimately dropping a Go ELF binary inside /app/deployment on target containers. Analysts note the use of HTTP/2 rapid reset attacks, Cloudflare UAM bypass, and large-scale HTTP floods to maximise traffic while evading mitigations.

The infrastructure appears to be cloud-native and multi-tenant, featuring an API and a login panel for operators, implying a DDoS-for-hire model rather than a traditional botnet. Initial access targets exposed Docker daemons on AWS EC2 instances, with reconnaissance suggesting CodeSpaces-hosted activity and UK- or Singapore-based origins for some connection attempts.

ShadowV2 blends containerisation, cloud tooling, and conventional malware techniques to broaden the scale and sophistication of DDoS capabilities, according to Darktrace.