Docker Engine API instances that are open to the internet are being used in a campaign that adds machines to a DDoS botnet called OracleIV. Attackers abuse misconfigured Docker containers to spread Python malware built as an ELF executable. The fix is to keep the Docker API off public networks and protect any remote access.
What is the OracleIV campaign against Docker?
Publicly accessible Docker Engine API instances have become the target of a campaign aiming to enlist machines into a distributed denial-of-service (DDoS) botnet named OracleIV.
How does the attack work?
It has been observed that attackers take advantage of misconfigurations in Docker containers to distribute Python malware compiled as an ELF executable. The attack chain reveals that attackers retrieve a shell script named ‘oracle.sh’ from a command-and-control (C&C) server. Before initiating malware infiltration, attackers scan through HTTP requests to identify security vulnerabilities. To avoid detection, the threat operates as a background service independent of the current user session.
What else is happening with Linux DDoS malware and exposed Docker?
Additionally, the DDoS malware XorDdos, infecting Linux devices, has resurfaced. This malicious software transforms Linux devices into zombies for subsequent DDoS attacks on selected targets.
Exposed Docker instances have become appealing targets in recent years, often exploited for cryptocurrency piracy campaigns. The OracleIV campaign was publicly reported in November 2023.
How can Docker users reduce the risk?
DockerHub users are encouraged to regularly assess images obtained from the registry to ensure they are not tainted with malicious code. Consistent with other attacks leveraging misconfigured services exposed to the internet (e.g., Jupyter, Redis, etc.), users of these services are strongly encouraged to periodically review the risks they face and implement network defenses accordingly.