ShadowV2 is a botnet built from hijacked cloud servers and rented out as a service. Researchers at Darktrace disclosed it on September 23, 2025, after catching it compromising exposed Docker environments running on Amazon Web Services. What sets it apart is not a new exploit but its business model: attackers who never touch the infrastructure can log into a polished web panel, pick a target and launch a DDoS attack, much as a customer would use any SaaS product.

That matters for two groups. Organizations running containers in the cloud need to make sure their misconfigured workloads are not the ones being conscripted. And any organization that depends on websites, APIs or cloud applications needs to treat availability as a first-class security objective, because attacks like these are now cheap and easy to buy.

How ShadowV2 builds its botnet

According to Darktrace’s analysis, the operators scan for Docker daemons exposed to the internet without authentication, a well-known misconfiguration. From infrastructure running on GitHub Codespaces, they use the Python Docker SDK to create a generic Ubuntu container on the victim host, install their tools inside it, save it as an image, and then deploy a new container from that image with its instructions passed through environment variables. Building the malicious container on the victim, rather than pulling a known-bad image from a registry, helps it avoid image-scanning defenses.

The payload is a remote-access tool written in Go that checks in with a Python-based command-and-control server and waits for attack orders. Each compromised cloud server becomes a worker with far more bandwidth and processing power than the home routers and cameras that make up traditional botnets.

Why do exposed Docker daemons keep turning up? Usually because someone opened the API for convenience during development or testing, attached a permissive security group, and moved on. Cloud makes it easy to launch a server in minutes and just as easy to forget it exists. Development and proof-of-concept environments are the most common culprits, precisely because they sit outside the change control and monitoring applied to production. Attackers scan the whole internet for these mistakes continuously, so an exposed API can be found and abused within hours of going live.

What it can do

• HTTP/2 Rapid Reset attacks. This technique, disclosed in October 2023 as CVE-2023-44487, abuses HTTP/2’s ability to open and immediately cancel streams, letting a modest number of machines generate enormous request rates. At its disclosure, Google, Cloudflare and AWS reported record-breaking attacks using it.
• Bypassing Cloudflare’s “Under Attack” mode. ShadowV2 uses ChromeDP, a headless browser automation tool, to try to solve the JavaScript challenges that Cloudflare presents to suspected bots, so its traffic looks more like real browsers.
• Large HTTP floods with proxy support, designed to blend in with legitimate traffic and exhaust application resources rather than just bandwidth.
• A service platform. The command-and-control system exposes a documented API with a login interface, user accounts with admin and user privilege levels, attack scheduling, target blacklists and worker monitoring. The result resembles a legitimate SaaS product more than a typical hacking tool.

The shift from raw volume to application-layer attacks is the important trend. A flood of HTTP requests aimed at a login page, search function or API endpoint can take down a service with far less traffic than a network-level attack, and it looks much more like real users. See our related coverage of how criminals abuse rented servers in proxy botnets hijacking VPS servers.

Don’t be part of the botnet: securing containers

If you run Docker or other container platforms in the cloud, these steps keep your infrastructure out of ShadowV2 and similar operations:

1. Never expose the Docker API to the internet. The daemon should listen only on a local socket. If remote management is truly needed, require TLS client certificates and restrict access by network.
2. Lock down cloud security groups. Audit for inbound rules that allow ports 2375 and 2376 from anywhere, and use cloud configuration monitoring to alert when such rules appear.
3. Monitor container behavior. Alert on new containers created outside your deployment pipeline, images built on production hosts, and unexpected outbound connections or traffic spikes from workloads.
4. Watch your cloud bill and egress. Sudden increases in compute or outbound traffic are often the first visible sign that a workload has been hijacked.

Don’t be the target: availability as a security objective

DDoS-for-hire lowers the bar for anyone with a grudge, a competitive motive or an extortion plan. Defending against it is mostly about having protection in place before an attack, because it is slow to set up in the middle of one:

• Put public services behind a DDoS-protection and web application firewall provider, such as a CDN with always-on mitigation. Our article on why a WAF is essential covers the setup.
• Rate-limit APIs and expensive endpoints, such as login, search and checkout, per client and per token.
• Keep web servers and load balancers patched for HTTP/2 issues like Rapid Reset, and hide origin servers so attackers cannot bypass the protection layer.
• Add DDoS scenarios to your incident response plan, with contacts at your hosting and protection providers, criteria for enabling stricter modes, and a communication plan for customers. Include hybrid and on-premises systems that depend on cloud services, since an outage in one can cascade to the other.

The trade-off is cost and some friction for legitimate users, such as occasional browser challenges. For most businesses whose revenue depends on being online, that is a small price. Our cybersecurity and compliance services include cloud configuration reviews and availability planning.

Update (September 2026): In November 2025 Fortinet’s FortiGuard Labs reported a separate, Mirai-based IoT botnet also calling itself ShadowV2, which exploited vulnerabilities in routers and other devices during the October 2025 AWS outage. Whether the two share operators is unclear, but together they show that DDoS capacity is being built from both cloud workloads and consumer devices.

Frequently asked questions

How do I know if our Docker hosts are exposed?

Check cloud security groups and host firewalls for open ports 2375 or 2376, and confirm the Docker daemon is not configured to listen on a network interface. External attack surface scans will also reveal exposed APIs.

Is DDoS protection only for large companies?

No. Entry-level CDN and WAF plans with DDoS mitigation are affordable for small businesses, and they are far cheaper than a day of downtime for an online store or client portal.

Can a hijacked workload create legal or financial exposure for us?

Yes. You pay for the compute and bandwidth the attackers use, your cloud provider may suspend the account, and your IP addresses may end up on blocklists.

Keeping your services available

Delana Technologies helps businesses secure cloud and container environments and design DDoS resilience for websites, APIs and hybrid systems. To review your exposure, call 239.414.5126 or contact us.

---

Sources: Darktrace, “ShadowV2: An emerging DDoS for hire botnet” (September 23, 2025); The Hacker News coverage of ShadowV2 (September 2025); CVE-2023-44487 disclosures by Google, Cloudflare and AWS (October 2023); Fortinet FortiGuard Labs, “ShadowV2 Casts a Shadow Over IoT Devices” (November 2025).