Cybersecurity researchers have uncovered a sophisticated new botnet called ShadowV2 that targets misconfigured Docker containers on Amazon Web Services (AWS) to create a powerful distributed denial-of-service (DDoS) attack network available for rent.

## How ShadowV2 Works

Discovered by Darktrace in June 2024, ShadowV2 employs a unique approach to compromise systems. Unlike traditional botnets that simply drop malicious images, ShadowV2 creates a generic Ubuntu container and installs attack tools directly within it. This method likely helps avoid leaving forensic evidence on victim machines.

The botnet operates through a Python-based command-and-control framework hosted on GitHub Codespaces, combined with a Go-based remote access trojan (RAT) that enables communication with operators via HTTP protocol.

## Advanced Attack Capabilities

What makes ShadowV2 particularly dangerous is its sophisticated toolkit, which includes:

– **HTTP/2 Rapid Reset attacks** for enhanced DDoS effectiveness
– **Cloudflare bypass techniques** using ChromeDP to solve JavaScript challenges
– **Large-scale HTTP floods** for overwhelming targets
– **Modular functionality** through containerization

The botnet’s command-and-control server, hidden behind Cloudflare, features a complete user interface and API endpoints that allow operators to manage users, configure attack types, and exclude certain targets from being attacked.

## DDoS-as-a-Service Business Model

ShadowV2 represents the evolution of cybercrime-as-a-service, offering a rental platform for conducting DDoS attacks. The professional-grade interface and structured API demonstrate how cybercriminals are adopting legitimate business practices to scale their operations.

## Growing DDoS Threat Landscape

This discovery coincides with record-breaking DDoS attacks. Cloudflare recently blocked attacks reaching 22.2 terabits per second and 10.6 billion packets per second – the largest ever recorded. These attacks, lasting only 40 seconds, were attributed to the AISURU botnet, which has infected nearly 300,000 devices worldwide.

## Key Takeaways

The emergence of ShadowV2 highlights several critical cybersecurity trends:

– **Cloud infrastructure vulnerability**: Misconfigured Docker containers remain prime targets
– **Professionalization of cybercrime**: Attack platforms now mirror legitimate software services
– **Escalating attack sophistication**: Modern botnets combine multiple advanced techniques
– **Global impact**: DDoS attacks continue to grow in scale and frequency

Organizations using cloud services, particularly Docker containers on AWS, should ensure proper configuration and monitoring to prevent becoming part of these attack networks.