Docker Engine API botnet

OracleIV is a dockerized DDoS botnet discovered by Cado Security Labs (now part of Darktrace) targeting publicly exposed Docker Engine APIs. The campaign delivers a malicious Docker container built from an image named oracleiv_latest, containing Python code compiled as a 64-bit ELF executable, and is designed to run DoS attacks via multiple techniques, including UDP floods and SSL floods.

The botnet communicates with a C2 server at 46.166.185[.]231 on port 40320, authenticating with a hardcoded password, and has been observed executing a range of DoS methods described in its code, such as UDP, UDP_PPS, SSL, SLOW, FIVE, VSE, and OVH variants. The malicious image, which had over 3,000 pulls on Docker Hub and was recently iterated, includes references to an Xmrig miner and related configuration files, though researchers did not observe mining in practice.

The article notes that misconfigured Docker Engine APIs continue to be targeted, with initial access typically achieved by pulling the malicious image after discovering the exposed endpoint, and it underscores the ongoing risk of publicly accessible containers for such campaigns, according to Darktrace.