Gafgyt Malware Targeting Misconfigured Docker Servers (Campaign)

Researchers observed threat actors leveraging misconfigured Docker Remote API servers to create containers (often from the alpine image), mount the host filesystem, escalate privileges, and deploy Gafgyt malware variants (e.g., rbot, atlas.i586). The campaign uses shell scripts (including a fallback cve.sh) to fetch multi-architecture binaries that connect to hardcoded C2 servers and carry out DDoS attacks using UDP, TCP, ICMP, HTTP, and SYN vectors, representing a shift from IoT-only targeting to abusing cloud/container misconfigurations.