All news with #container breakout tag

ShadowV2 Turns Misconfigured Docker into DDoS Service

🛡️ Darktrace researchers uncovered a ShadowV2 campaign that leverages exposed Docker APIs on AWS EC2 to provision containers and run a Go-based remote access trojan, converting misconfigured cloud containers into distributed DDoS nodes. The attackers create containers on victim hosts rather than importing malicious images, likely to reduce forensic traces, and use the Python Docker SDK to interact with exposed daemons. ShadowV2 operators employ advanced techniques including HTTP/2 rapid reset and Cloudflare evasion, and the platform includes APIs, a Tailwind/FastAPI UI and operator logins that turn botnet control into a commercialized DDoS-as-a-Service offering.

Critical Code-Execution CVEs Found in Chaos-Mesh Platform

⚠️ JFrog Security Research disclosed multiple CVEs in Chaos-Mesh, including three critical flaws that permit in-cluster attackers to execute arbitrary code on any pod. The Chaos Controller Manager exposes an unauthenticated ClusterIP GraphQL /query endpoint on port 10082 by default, enabling mutations such as killProcesses and cleanTcs. The critical issues (CVSS 9.8) arise from unsafe command construction in resolvers and an ExecBypass routine that allows OS command injection. Operators should upgrade to Chaos-Mesh 2.7.3 immediately; as a temporary mitigation redeploy the Helm chart with the control server disabled.

Cryptominer targets exposed Docker APIs, installs backdoors

🔒 Akamai researchers reported a June–August 2025 variant that no longer drops a cryptominer but instead leverages exposed Docker APIs to gain persistent host access. The campaign launches lightweight containers that mount the host filesystem and fetch Base64-encoded scripts over Tor to install tools such as curl and tor. Once inside, the malware appends SSH keys, creates cron jobs, and attempts to modify firewall rules to deny others access to port 2375. Akamai also observed dormant logic to probe Telnet and Chrome remote debugging (9222), suggesting future botnet expansion.

Docker fixes critical container escape CVE-2025-9074

🚨Docker has released an urgent patch for CVE-2025-9074, a critical container escape flaw in Docker Desktop for Windows and macOS that carries a CVSS score of 9.3. A malicious container could reach the Docker Engine API at 192.168.65.7:2375 without authentication, create and start new containers that bind the host C:\ drive and thereby access or modify host files. The issue is fixed in version 4.44.3; Enhanced Container Isolation (ECI) does not mitigate the vulnerability. Linux desktop installations are not affected because they use a host named pipe instead of a TCP socket.