XORDDoS, Kaiji DDoS Botnets Target Docker Servers

guest · Jun 23, 2020

XORDDoS, Kaiji DDoS Botnets Target Docker Servers
June 23, 2020
https://www.securityweek.com/xorddos-kaiji-ddos-botnets-target-docker-servers

XORDDoS, also known as XOR.DDoS, has been around since 2014 and it has been targeting Linux systems. Kaiji, whose existence was brought to light earlier this year, is a Golang-based piece of malware that has targeted Linux systems, including IoT devices. Both threats have been linked to China.

According to the security firm, the hackers are looking for Docker servers that expose port 2375. This is one of the two ports of the Docker API and it’s used for unauthenticated and unencrypted communications.
The main difference between how XORDDoS and Kaiji target Docker servers is that the former infects all existing containers on the server, while the latter deploys the malware in its own container.
Click to expand...

Trend Micro researchers have also found a link between XORDDoS and a DDoS botnet tracked as AESDDoS and Dofloo, which has been known to target Docker.

In the case of Kaiji, its operators scan the web for exposed Docker servers and deploy an ARM container hosting the malware.
Kaiji also harvests information about the compromised system.
Click to expand...

Trend Micro: XORDDoS, Kaiji Botnet Malware Variants Target Exposed Docker Servers

As seen in these findings, threat actors behind malware variants constantly upgrade their creations with new capabilities so that they can deploy their attacks against other entry points. As they are relatively convenient to deploy in the cloud, Docker servers are becoming an increasingly popular option for companies.
Click to expand...

Log in or Sign up

XORDDoS, Kaiji DDoS Botnets Target Docker Servers

guest Guest

Log in or Sign up

XORDDoS, Kaiji DDoS Botnets Target Docker Servers

guest Guest

Useful Searches