ShadowV2 Botnet Targets Exposed Docker Daemons and Offers DDoS-for-Hire Capabilities
Summary
Darktrace analyzes ShadowV2, a campaign using a Python spreader and Go-based RAT to infect exposed Docker daemons, control compromised systems through an API, and launch HTTP flood and HTTP/2 rapid reset attacks.
Key points
- Darktrace observed the campaign targeting exposed Docker daemons on AWS EC2 honeypots; the attackers build and deploy containers on the compromised systems.
- A Python spreader is associated with GitHub CodeSpaces, while a Go-based RAT registers with a C2 server and polls it for commands.
- The implant can launch HTTP floods and HTTP/2 rapid reset attacks, with options including randomized query strings, spoofed forwarding headers, and a Cloudflare challenge bypass.
- Researchers intercepted a command configuring a 120-thread HTTP/2 rapid reset attack against a target site.
- The C2 API and login panel include user and privilege management, attack controls, and a host blacklist, leading Darktrace to assess the platform as likely intended for DDoS-for-hire use.
- Darktrace recommends monitoring containerized environments, cloud workloads, and anomalous API and container activity.
Article Details
- Attack Vectors
- Targets exposed Docker daemons, with observed attacks against honeypots running on AWS EC2.
- Uses a Python spreader and a multi-stage Docker deployment to install tools in a setup container, image it, and deploy a live container.
- The Go-based implant registers with its C2 and polls for commands over HTTP.
- Performs HTTP floods and HTTP/2 rapid reset attacks; optional mechanisms include spoofed forwarding headers, random query strings, and a Cloudflare Under Attack Mode bypass using a bundled ChromeDP binary.
- Defensive Notes
- Restrict external access to Docker daemons and monitor container creation, imaging, and deployment activity.
- Maintain deep visibility into containerized environments and continuously monitor cloud workloads for anomalous API usage and container orchestration patterns.
- Use behavioral analytics to detect suspicious HTTP-based command-and-control activity and denial-of-service traffic.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | shadow[.]aurozacloud[.]xyz | C2 domain used by the ShadowV2 malware. |
| IPV4 | 23[.]97[.]62[.]136 | Listed as a spreader IP. |
| IPV4 | 23[.]97[.]62[.]139 | Listed as a spreader IP; the article identifies it as the source of connections and says it is a Microsoft IP. |
| SHA256 | 1b552d19a3083572bc433714dfbc2b75eb6930a644696dedd600f9bd755042f6 | SHA-256 hash listed as a ShadowV2 malware artifact. |
| SHA256 | 1f70c78c018175a3e4fa2b3822f1a3bd48a3b923d1fbdeaa5446960ca8133e9c | SHA-256 hash listed as a ShadowV2 malware artifact. |
| SHA256 | 2462467c89b4a62619d0b2957b21876dc4871db41b5d5fe230aa7ad107504c99 | SHA-256 hash listed as a ShadowV2 malware artifact. |
| URL | hxxps[:]//shadow[.]aurozacloud[.]xyz/api/vps/heartbeat | C2 endpoint the malware uses to send implant heartbeats. |
MITRE ATT&CK
T1071.001 · Web ProtocolsThe implant uses HTTP POST requests for registration and heartbeats and HTTP GET requests to poll its C2 for commands.T1498.001 · Direct Network FloodThe malware performs HTTP floods and HTTP/2 rapid reset attacks against target sites.T1610 · Deploy ContainerThe spreader creates and configures a Docker container, images it, and deploys it as a live container.
Malware
Vendors
Amazon Web ServicesThis campaign targets exposed Docker daemons, specifically those running on AWS EC2. Darktrace runs a number of honeypots across multiple cloud providers and has only observed attacks against honeypots running on AWSCloudflareThe threat actors employ advanced methods such as HTTP/2 rapid reset, a Cloudflare under attack mode (UAM) bypass, and large-scale HTTP floods, demonstrating a capability to combine distributed denial-of-service (DDoS)GitHubAt the center of this campaign is a Python-based command-and-control (C2) framework hosted on GitHub CodeSpaces. This campaign also utilizes a Python based spreader with a multi-stage Docker deployment as the initialMicrosoftThe IP the connections originate from is 23.97.62[.]139, which is a Microsoft IP based in Singapore. This aligns with expectations as GitHub is owned by Microsoft.
Products
AWS EC2This campaign targets exposed Docker daemons, specifically those running on AWS EC2. Darktrace runs a number of honeypots across multiple cloud providers and has only observed attacks against honeypots running on AWSCloudflareThe threat actors employ advanced methods such as HTTP/2 rapid reset, a Cloudflare under attack mode (UAM) bypass, and large-scale HTTP floods, demonstrating a capability to combine distributed denial-of-service (DDoS)Dockerhosted on GitHub CodeSpaces. This campaign also utilizes a Python based spreader with a multi-stage Docker deployment as the initial access vector.GitHub CodeSpacesAt the center of this campaign is a Python-based command-and-control (C2) framework hosted on GitHub CodeSpaces. This campaign also utilizes a Python based spreader with a multi-stage Docker deployment as the initial