ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoS-for-Hire Service

ShadowV2 is a rental-style botnet described by Darktrace as targeting misconfigured Docker containers on AWS cloud servers to deploy a Go-based malware that turns infected systems into attack nodes for a larger DDoS-for-hire operation. The researchers said they detected the malware targeting honeypots on 24 June 2025. At the centre of the campaign is a Python-based command-and-control framework hosted on GitHub Codespaces, according to Nathaniel Bill.

The attackers reportedly use advanced techniques such as HTTP/2 Rapid Reset, a Cloudflare Under Attack Mode bypass, and large-scale HTTP floods to mix DDoS methods with targeted exploitation. ShadowV2 spreads via a Python-based module to breach Docker daemons, primarily on AWS EC2, and the Go-based RAT enables command execution and tells its operators via the HTTP protocol.

The C2 server, shadow.aurozacloud[.]xyz, is described as being behind Cloudflare, with an API that supports operator management, attack configuration, and target lists to sustain a DDoS-for-hire service.