Loading threat actor…
ShadowV2 is a Mirai-based botnet and Mirai offshoot focused on compromising internet-exposed infrastructure, particularly IoT devices such as routers and, in separate activity, misconfigured Docker daemons on Amazon Web Services cloud instances. It has been associated with distributed denial-of-service operations and has been described as supporting a DDoS-for-hire model. Observed ShadowV2 activity in late 2025 coincided with a major AWS outage and was assessed as a likely test run for future attacks. ShadowV2 has been reported exploiting known vulnerabilities affecting D-Link, TP-Link, and GeoVision devices, and has targeted vulnerable routers across multiple countries. In cloud-focused operations, it has been observed abusing exposed or misconfigured Docker environments on AWS to deploy malware that converts compromised systems into botnet nodes. Reported payloads include ELF malware for Linux-based environments and Go-based malware in Docker-targeting campaigns. Operationally, ShadowV2 aligns with established Mirai tradecraft: opportunistic exploitation of exposed services and vulnerable embedded devices, rapid propagation across heterogeneous internet-facing targets, and use of infected hosts as attack nodes for large-scale DDoS activity. High-confidence reporting indicates activity across 28 countries during the late-2025 campaign window. No reliable attribution to a specific nation-state or country of origin is currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ShadowV2 is a Mirai variant that opportunistically exploited the October 2025 AWS outage to test its capabilities across 28 countries. It targets IoT devices using known vulnerabilities, focusing on D-Link, TP-Link, and GeoVision products, and is responsible for significant DDoS attacks, particularly in the technology and retail sectors.
ShadowV2 is a Mirai variant that opportunistically exploited the October 2025 AWS outage to infect IoT devices across 28 countries, focusing on D-Link, TP-Link, and GeoVision vulnerabilities, and launching DDoS attacks against technology and retail targets.
ShadowV2 is a Mirai-based botnet targeting IoT devices globally, exploiting multiple vulnerabilities to recruit devices for DDoS attacks. The recent campaign appears to be a test run for future attacks.
ShadowV2 is a botnet campaign targeting misconfigured Docker containers to deploy Go-based RATs for DDoS attacks, operating as a for-hire service.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.