Executive Summary
In September 2025, researchers uncovered that the ShadowV2 botnet exploited misconfigured Docker containers deployed on Amazon Web Services (AWS) instances. Attackers leveraged these open containers to install Go-based malware, transforming vulnerable cloud servers into nodes for distributed denial-of-service (DDoS) attacks available for hire. The botnet operators were able to saturate targets’ networks and disrupt organizational operations using cloud-scale resources, highlighting a sophisticated abuse of both infrastructure-as-a-service offerings and container orchestration weaknesses. The campaign predominantly impacted organizations with unmanaged or lax security practices around containerized workloads and cloud network borders.
This attack underscores the growing trend of threat actors targeting cloud misconfigurations and using them as platforms for broader cybercriminal infrastructure. The incident reflects both the increasing commoditization of DDoS-as-a-service and the urgency of securing cloud-native deployments against well-known attack patterns.
Why This Matters Now
The ShadowV2 botnet demonstrates how misconfigured cloud environments can be instantly weaponized for large-scale attacks. With the rapid proliferation of containerized workloads and public cloud usage, urgent action is required to audit and secure Docker and similar deployments to prevent abuse, regulatory exposure, and cascading business disruption.
Attack Path Analysis
The ShadowV2 botnet campaign began with the exploitation of misconfigured Docker containers on AWS cloud servers, allowing attackers to deploy Go-based malware. Once compromised, adversaries gained foothold to potentially escalate privileges within the container or host environment. The threat actor then leveraged access for lateral movement to identify additional vulnerable cloud resources and workloads. Compromised systems established persistent command and control (C2) channels to join the distributed botnet infrastructure. While the primary aim was not exfiltration, attackers may have leveraged outbound connectivity for tool or payload delivery. Ultimately, affected hosts participated in DDoS-for-hire attacks, causing service disruption and resource abuse.
Kill Chain Progression
Initial Compromise
Description
Adversaries exploited internet-exposed, misconfigured Docker containers on AWS to gain initial access and execute malware.
Related CVEs
CVE-2021-21285
CVSS 6.5A flaw in Docker allows pulling an intentionally malformed image manifest to crash the dockerd daemon, resulting in a denial of service.
Affected Products:
Docker Docker Engine – < 20.10.3
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Container Administration Command
Deploy Container
User Execution
Acquire Infrastructure: Web Services
Resource Hijacking
Endpoint Denial of Service
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Configuration Standards for System Components
Control ID: 6.4.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA (Digital Operational Resilience Act) – ICT Risk Management Framework
Control ID: Article 9
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Secure Workload Deployment
Control ID: Pillar: Workload, Capability: Secure Workload Deployment
NIS2 Directive – Supply Chain Security and Secure Development
Control ID: Article 21(2)(d)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
Cloud misconfiguration vulnerabilities expose Docker containers on AWS to ShadowV2 botnet exploitation, requiring enhanced container security and zero trust segmentation implementation.
Computer Software/Engineering
Go-based malware targeting misconfigured Docker environments threatens software development infrastructure, demanding improved Kubernetes security and east-west traffic monitoring capabilities.
Financial Services
DDoS-for-hire services exploiting cloud misconfigurations pose availability risks to critical financial systems, necessitating robust egress security and threat detection measures.
Health Care / Life Sciences
Cloud container vulnerabilities threaten HIPAA compliance through potential data exfiltration and service disruption, requiring multicloud visibility and encrypted traffic protection.
Sources
- ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoS-for-Hire Servicehttps://thehackernews.com/2025/09/shadowv2-botnet-exploits-misconfigured.htmlVerified
- ShadowV2 Botnet Uses AWS Docker Containers as Infected Hosts for DDoS Attackshttps://cyberpress.org/shadowv2-botnet/Verified
- ShadowV2 Botnet Uses Misconfigured AWS Docker for DDoS-For-Hire Servicehttps://hackread.com/shadowv2-botnet-aws-docker-ddos-for-hire-service/Verified
- ShadowV2 Botnet Exploits Misconfigured AWS Docker Containers for DDoS-for-Hire Servicehttps://blog.netmanageit.com/shadowv2-botnet-exploits-misconfigured-aws-docker-containers-for-ddos-for-hire-service/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Applying Cloud Network Security Framework controls such as zero trust segmentation, east-west traffic security, centralized visibility, inline threat detection, and robust egress enforcement would have limited adversary movement, minimized the attack surface, and prevented compromised workloads from joining malicious botnets.
Control: Zero Trust Segmentation
Mitigation: Reduces attack surface by restricting exposure of workloads and limiting network reachability.
Control: Kubernetes Security (AKF)
Mitigation: Limits IAM and pod-level privilege escalation between Kubernetes workloads.
Control: East-West Traffic Security
Mitigation: Detects and prevents unauthorized internal traffic between cloud workloads.
Control: Egress Security & Policy Enforcement
Mitigation: Prevents or detects attempts to connect to known malicious C2 infrastructure.
Control: Cloud Firewall (ACF)
Mitigation: Restricts outbound channels to explicitly allowed destinations, reducing risk of exfiltration.
Enables rapid detection and response to botnet membership and anomalous outbound behaviors.
Impact at a Glance
Affected Business Functions
- Cloud Infrastructure Management
- Network Operations
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of cloud service configurations and access credentials due to exploitation of misconfigured Docker containers.
Recommended Actions
Key Takeaways & Next Steps
- • Enforce strict zero trust segmentation to prevent direct internet access to workloads and reduce exposure from cloud misconfigurations.
- • Implement robust Kubernetes security and namespace controls to limit escalation paths within container environments.
- • Apply continuous east-west traffic monitoring and microsegmentation to detect and block lateral movement in cloud environments.
- • Enforce granular egress policies and FQDN/URL filtering to stop outbound C2 communications and protect against exfiltration or botnet recruitment.
- • Leverage real-time threat detection and centralized multicloud visibility to accelerate incident response and contain abnormal workload behaviors.
