Loading malware…
ShadowV2 is a Mirai-based botnet malware family used to compromise vulnerable internet-connected devices and cloud-hosted systems for distributed denial-of-service operations. It has been observed in two closely related operational patterns: exploitation of exposed or misconfigured Docker environments on AWS EC2 to deploy a Go-based implant, and exploitation of known vulnerabilities in IoT devices such as routers, DVRs, NAS appliances, and network video recorders to conscript them into a botnet.
In cloud-focused activity, ShadowV2 used a Python-based spreader and command infrastructure to interact with exposed Docker daemons, create or customize containers on victim hosts, and deploy a Go ELF implant. The implant registered with a REST-style command-and-control service, maintained heartbeat and polling loops, and received attack tasks remotely. Reported attack functionality included high-volume HTTP flooding and HTTP/2 rapid reset techniques, along with options intended to improve effectiveness or bypass protections, such as randomized query strings, spoofed forwarding headers, and Cloudflare challenge bypass logic using browser automation.
In IoT-focused activity, ShadowV2 was described as a Mirai offshoot or variant resembling other Mirai-derived strains. It propagated by exploiting multiple known vulnerabilities affecting devices from several vendors, including D-Link, TP-Link, DigiEver, TBK, and DD-WRT-associated targets. Reported campaigns also linked ShadowV2 delivery to exploitation of additional vulnerable edge and industrial networking products. The malware used downloader-based infection chains and supported Mirai-style command-and-control driven flooding over UDP, TCP, and HTTP. Activity was observed globally across sectors including government, technology, manufacturing, telecommunications, education, managed security services, retail, and hospitality.
ShadowV2 has been characterized as part of a DDoS-for-hire ecosystem and as a botnet primarily oriented toward attack-node creation rather than espionage. Reporting tied it to opportunistic exploitation of unpatched, end-of-life, or misconfigured systems, including campaigns active during a major AWS outage that appeared to function as a test run across multiple countries. The family illustrates the continued evolution of Mirai-derived botnets toward hybrid targeting of both traditional IoT infrastructure and cloud-native deployments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Fortinet sensors detected active exploitation attempts linked to a Mirai-based botnet known as ShadowV2... Exploiting - CVE-2020-25506 ... D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution. | Fortinet sensors detected active exploitation attempts linked to a Mirai-based botnet known as ShadowV2. This variant was propagating through multiple vulnerabilities identified and blocked by our Intrusion Prevention System (IPS). ShadowV2 had previously been observed targeting AWS EC2 instances in campaigns disclosed in September.
CVE-2024-10914 ... D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection ... Fortinet sensors detected active exploitation attempts linked to a Mirai-based botnet known as ShadowV2. | Fortinet sensors detected active exploitation attempts linked to a Mirai-based botnet known as ShadowV2. This variant was propagating through multiple vulnerabilities identified and blocked by our Intrusion Prevention System (IPS). ShadowV2 had previously been observed targeting AWS EC2 instances in campaigns disclosed in September.
CVE-2024-10915 ... D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection ... Fortinet sensors detected active exploitation attempts linked to a Mirai-based botnet known as ShadowV2. | Fortinet sensors detected active exploitation attempts linked to a Mirai-based botnet known as ShadowV2. This variant was propagating through multiple vulnerabilities identified and blocked by our Intrusion Prevention System (IPS). ShadowV2 had previously been observed targeting AWS EC2 instances in campaigns disclosed in September.
Exploiting - CVE-2022-37055 ... D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main. | Fortinet sensors detected active exploitation attempts linked to a Mirai-based botnet known as ShadowV2. This variant was propagating through multiple vulnerabilities identified and blocked by our Intrusion Prevention System (IPS). ShadowV2 had previously been observed targeting AWS EC2 instances in campaigns disclosed in September.
In the past year, it was exploited to spread different bots, including a Mirai-based strain, the ShadowV2 botnet, and a newer botnet known as RondoDox. | FortiGuard Labs has analyzed a recent campaign exploiting CVE-2024-3721 in TBK DVR devices to deliver a multi-architecture Mirai variant called Nexcorium. Attackers exploit CVE-2024-3721, a command injection flaw, to compromise devices and turn them into bots for DDoS attacks.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
CVE-2022-37055 - D-Link Go-RT-AC750 ... are vulnerable to Buffer Overflow via cgibin, hnap_main | Fortinet sensors detected active exploitation attempts linked to a Mirai-based botnet known as ShadowV2. This variant was propagating through multiple vulnerabilities... Exploiting - CVE-2020-25506 ... CVE-2022-37055 ... CVE-2024-10914 ... CVE-2024-10915
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A botnet mentioned as one of the malware families spread via exploitation of the same TBK DVR flaw in real-world campaigns.
Go-based botnet that targets misconfigured AWS-hosted Docker containers to build DDoS-for-hire attack infrastructure.
ShadowV2 is a botnet malware that, like Mirai, is used to compromise vulnerable devices and conscript them into a botnet for malicious purposes such as DDoS attacks.
ShadowV2 is a botnet and cryptocurrency miner malware family delivered through exploitation of router vulnerabilities in OT environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.