Threat Alert: Exploiting Open Docker Daemons for DDoS Attacks

This report details two DDoS campaigns in which attackers exploited misconfigured open Docker daemons to deploy containerized botnets using modified udpflood and slowhttptest binaries; the analysis covers binary comparisons to open-source versions, attack chain (scanning, image creation/upload, remote deployment), targeting of Alibaba Cloud hosts, and provides IOCs and mitigation advice to secure Docker daemons and enforce image assurance.