A sophisticated cybercrime campaign has emerged that transforms legitimate AWS infrastructure into weaponized attack platforms through an innovative combination of containerization and distributed denial-of-service capabilities.

The ShadowV2 botnet represents a significant evolution in cyber threats, leveraging exposed Docker daemons on Amazon Web Services EC2 instances to establish persistent footholds for large-scale DDoS operations.

This campaign demonstrates an alarming shift toward professional, service-oriented cybercrime infrastructure that mirrors legitimate cloud-native applications in both design and functionality.

The attack begins with threat actors operating from GitHub CodeSpaces, utilizing a Python-based command-and-control framework to scan for and exploit misconfigured Docker installations.

Unlike traditional botnet operations that rely on pre-built malicious containers, ShadowV2 employs a unique multi-stage deployment process that creates custom containerized environments directly on victim machines.

The malware establishes communication with its operators through a RESTful API architecture, implementing sophisticated polling and heartbeat mechanisms that ensure persistent connectivity while evading detection through legitimate-appearing network traffic.

Darktrace analysts identified the malware during routine honeypot monitoring, discovering that the campaign specifically targets AWS EC2 instances running exposed Docker daemons.

The researchers observed the threat actors using advanced attack techniques including HTTP/2 rapid reset attacks, Cloudflare under-attack mode bypasses, and large-scale HTTP flood campaigns.

These capabilities, combined with a fully operational user interface and OpenAPI specification, indicate that ShadowV2 functions as a comprehensive DDoS-as-a-service platform rather than a traditional botnet, offering paying customers the ability to launch sophisticated distributed attacks against targeted infrastructure.

The malware’s architecture reveals a concerning level of professionalism, with the entire operation designed around a modular, service-oriented approach that includes user authentication, privilege management, and attack limitations based on subscription tiers.

This evolution represents a fundamental shift in cybercrime economics, where malicious infrastructure increasingly resembles legitimate software-as-a-service offerings in terms of user experience, reliability, and feature completeness.

Technical Infection and Deployment Mechanism

The ShadowV2 botnet employs a sophisticated three-stage deployment process that distinguishes it from conventional Docker-based malware campaigns.

Initial compromise occurs through Python scripts hosted on GitHub CodeSpaces, identifiable through distinctive HTTP headers including User-Agent: docker-sdk-python/7.1.0 and X-Meta-Source-Client: github/codespaces.

These indicators reveal the attackers’ use of the Python Docker SDK library, which enables programmatic interaction with Docker daemon APIs to create and manage containerized environments on target systems.

The attack methodology deviates significantly from typical Docker exploitation patterns. Instead of deploying pre-built malicious images from Docker Hub or uploading custom containers, the malware first spawns a generic Ubuntu-based setup container and dynamically installs necessary tools within it.

This container is then committed as a new image and deployed as a live container with malware arguments passed through environmental variables including MASTER_ADDR and VPS_NAME identifiers.

The containerized payload consists of a Go-based ELF binary located at /app/deployment that implements a robust communication protocol with the command-and-control infrastructure.

Upon execution, the malware generates a unique VPS_ID by concatenating the provided VPS_NAME with the current Unix timestamp, ensuring distinct identification for each compromised system.

This identifier facilitates command routing and maintains session continuity even across malware restarts or reinfections.

The binary establishes two persistent communication loops: a heartbeat mechanism that transmits the VPS_ID to hxxps://shadow.aurozacloud[.]xyz/api/vps/heartbeat every second via POST requests, and a command polling system that queries hxxps://shadow.aurozacloud[.]xyz/api/vps/poll/<VPS_ID> every five seconds through GET requests.

This dual-channel approach ensures both operational visibility for attackers and reliable command delivery to compromised infrastructure, while maintaining the appearance of legitimate API traffic that can evade network-based detection mechanisms.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post ShadowV2 Botnet Exploits Docker Containers on AWS to Turn Thems as Infected System for DDoS Attack appeared first on Cyber Security News.

A sophisticated new malware family dubbed YiBackdoor has emerged in the cybersecurity landscape, posing a significant threat to organizations worldwide.

First observed in June 2025, this malicious software represents a concerning evolution in backdoor technology, featuring advanced capabilities that enable threat actors to execute arbitrary commands, capture screenshots, collect sensitive system information, and deploy additional malicious plugins on compromised hosts.

The malware’s architecture demonstrates significant code overlaps with established threats IcedID and Latrodectus, suggesting potential collaboration between threat actor groups or shared development resources.

Similar to notorious banking trojans like Zloader and Qakbot, IcedID was originally designed for facilitating financial fraud but has since evolved into a primary tool for providing initial access to ransomware operators.

YiBackdoor appears to follow this same trajectory, potentially serving as a gateway for more destructive cyberattacks.

Zscaler analysts identified YiBackdoor through comprehensive threat hunting activities and noted its sophisticated anti-analysis capabilities designed to evade detection by security researchers and automated sandbox environments.

The malware demonstrates advanced virtual environment detection techniques, including hypervisor identification for VMware, Xen, KVM, VirtualBox, Microsoft Hyper-V, and Parallels systems.

The malware’s limited deployment patterns suggest it may currently be in a development or testing phase, according to security researchers.

However, its advanced capabilities and connection to established malware families indicate that broader deployment campaigns could emerge as development progresses.

The threat actor’s use of local IP addresses in configuration files further supports the assessment that YiBackdoor remains in active development.

Code Injection and Persistence Mechanisms

YiBackdoor employs a sophisticated process injection technique that sets it apart from conventional malware families.

The malware utilizes a unique approach to achieve code execution within legitimate system processes, specifically targeting svchost.exe for its injection operations.

During the initialization phase, YiBackdoor performs a critical check to determine whether it is already running within an injected process by examining its current memory address against loaded DLL ranges.

If the malware detects it is not yet injected, it creates a new svchost.exe process and begins the injection sequence.

The malware allocates memory within the target process and copies its malicious code into the newly created memory region.

The most notable aspect of YiBackdoor’s injection technique involves patching the Windows API function RtlExitUserProcess with custom assembly code.

This patch redirects execution flow to YiBackdoor’s entry point when the function is called, effectively hijacking the process termination sequence.

The following code demonstrates the hypervisor detection mechanism used by the malware:-

[[nodiscard]] bool isHyperVisor()
{
   uint64_t timer1 = 0;
   uint64_t timer2 = 0;
   int loop_counter = 16;
   int cpuInfo[4] = { 0 };
   while (loop_counter)
   {
       SwitchToThread();
       uint64_t first_rdtsc_timer_value = __rdtsc();
       __cpuid(cpuInfo, 1);
       timer1 += __rdtsc() - first_rdtsc_timer_value;
       SwitchToThread();
       uint64_t second_rdtsc = __rdtsc();
       uint64_t third_rdtsc = __rdtsc();
       timer2 += ((third_rdtsc - second_rdtsc));
       loop_counter--;
   }
   return (timer1 > 20);
}

Persistence establishment occurs through Windows Registry manipulation, where YiBackdoor copies itself to a randomly named directory and creates registry entries using regsvr32.exe for automatic execution upon system startup.

The malware generates pseudo-random values for registry key names using Microsoft’s Linear Congruential Generator algorithm, making detection through static signatures more challenging for security products.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New YiBackdoor Allows Attackers to Execute Arbitrary Commands and Exfiltrate Sensitive Data from Hacked Systems appeared first on Cyber Security News.