• United States



UK Editor

Pro-Ukrainian DoS attack compromises Docker Engine honeypots to target Russian, Belarusian websites

May 04, 20222 mins

CrowdStrike detects denial-of-service attack using Docker images with target lists that overlap with domains reportedly shared by the Ukraine government-backed Ukraine IT Army.

clicks pageviews traffic denial of service ddos attack 100613842 orig
Credit: Thinkstock

Researchers from cybersecurity vendor CrowdStrike have detected a denial-of-service (DoS) attack compromising Docker Engine honeypots to target Russian and Belarusian websites amid the ongoing Russia-Ukraine war. According to the firm, the honeypots were compromised four times between February 27 and March 1, 2022, with two different Docker images that both share target lists that overlap with domains reportedly shared by the Ukraine government-backed Ukraine IT Army.

CrowdStrike has therefore linked the attacks to pro-Ukrainian activity against Russia. It has also warned of the risk of retaliatory activity by threat actors supporting the Russian Federation against organizations being leveraged to conduct disruptive attacks against government, military, and civilian websites.

Honeypots compromised via exposed Docker Engine API

The honeypots were compromised via an exposed Docker Engine API in a technique commonly used by opportunistic campaigns such as LemonDuck or WatchDog to infect misconfigured container engines, CrowdStrike stated in a blog posting. The first Docker image used in the attack was observed in three out of the four incidents and is hosted on Docker Hub.

“This image has been downloaded over100,000 times, but CrowdStrike Intelligence cannot assess how many of these downloads originate from compromised infrastructure. The Docker image contains a Go-based HTTP benchmarking tool named bombardier…that uses HTTP-based requests to stress-test a website,” the vendor added.

Targeted websites include those in the government, military, media, and retail sectors in both Russia and Belarus. “CrowdStrike Intelligence assesses the activity deploying this Docker image as very likely automated based on closely overlapping timelines in the interaction with the Docker API,” CrowdStrike said.

The second Docker image used in the attack has been downloaded over 50,000 times from DockerHub, CrowdStrike continued. “The image contains a custom Go-based DoS program named stoppropaganda…that sends HTTP GET requests to a list of target websites that overloads them with requests. Again, the attack focused on websites of the Russian and Belarusian media, government, military, energy, mining, and finance sectors.”

UK Editor

Michael Hill is the UK editor of CSO Online. He has spent the past 8 years covering various aspects of the cybersecurity industry, with particular interest in the ever-evolving role of the human-related elements of information security. A keen storyteller with a passion for the publishing process, he enjoys working creatively to produce media that has the biggest possible impact on the audience.

More from this author