Cybersecurity researchers have identified ShadowV2, a newly emerging botnet designed as a commercial DDoS-for-hire service. The campaign targets misconfigured Docker containers—primarily on Amazon Web Services (AWS)—to deploy a Go-based remote access trojan (RAT) and conscript cloud systems into high-performance DDoS attack nodes. ShadowV2 leverages advanced methods such as HTTP/2 Rapid Reset, Cloudflare bypass techniques, and modular containerized deployment. The findings highlight the rapid evolution of cybercrime-as-a-service and the increasing weaponization of cloud misconfigurations.

Botnets built for DDoS attacks have traditionally relied on compromised consumer IoT devices. In contrast, ShadowV2 targets enterprise cloud infrastructure, enabling more powerful and scalable attack capabilities. Misconfigured Docker daemons are a recurring weak point: exposed APIs allow attackers to deploy arbitrary containers or manipulate live workloads.

ShadowV2 arrives at a time when DDoS attacks are reaching historic volumes, including Cloudflare’s recently blocked 22.2 Tbps event—now the largest ever recorded.

Darktrace researchers observed ShadowV2 activity on June 24, 2025, when the botnet attempted to infect its honeypots. Key characteristics include:

The botnet is marketed by its operators as an “advanced attack platform,” offering customizable attack parameters via an integrated API and operator dashboard.

ShadowV2 relies on:

This layered approach may reduce forensic artifacts by performing installation actions directly inside the victim’s environment.

The RAT communicates with:

The C2 uses FastAPI, Pydantic, and a login-protected operator UI supporting:

ShadowV2 implements:

Although the UAM bypass is likely ineffective against modern anti-automation measures, its inclusion shows active development and operator experimentation.

ShadowV2’s focus on cloud container takeover introduces significant risks:

The emergence of a full operator UI and rentable access strongly indicates a commercial cybercrime-as-a-service model, lowering the barrier for buyers to launch sophisticated DDoS operations.

Additionally, the discovery parallels broader botnet activity:

The ecosystem around DDoS-as-a-service is maturing, with multiple actors adopting modular, cloud-based models.

ShadowV2 exemplifies major trends reshaping modern cybercrime:

Organizations with exposed Docker daemons face severe risk of being pulled into a botnet—and being used to attack others.

Nathaniel Bill of Darktrace notes that ShadowV2’s modular API, Go-based RAT, and containerization show “the continued development of cybercrime-as-a-service,” emphasizing that threat actors are applying professional software design principles to offensive tooling.

QiAnXin XLab researchers warn that global botnet activity is accelerating, with AISURU launching attacks across China, the U.S., Germany, the U.K., and Hong Kong, and integrating anonymization features that appeal to buyers seeking evasion.