Pro-Ukrainian DoS attack compromises Docker Engine honeypots to target Russian, Belarusian websites

Researchers from cybersecurity vendor CrowdStrike have detected a denial-of-service (DoS) attack compromising Docker Engine honeypots to target Russian and Belarusian websites amid the ongoing Russia-Ukraine war. According to the firm, the honeypots were compromised four times between February 27 and March 1, 2022, with two different Docker images that both share target lists that overlap with domains reportedly shared by the Ukraine government-backed Ukraine IT Army.

CrowdStrike has therefore linked the attacks to pro-Ukrainian activity against Russia. It has also warned of the risk of retaliatory activity by threat actors supporting the Russian Federation against organizations being leveraged to conduct disruptive attacks against government, military, and civilian websites.

Honeypots compromised via exposed Docker Engine API

The honeypots were compromised via an exposed Docker Engine API in a technique commonly used by opportunistic campaigns such as LemonDuck or WatchDog to infect misconfigured container engines, CrowdStrike stated in a blog posting. The first Docker image used in the attack was observed in three out of the four incidents and is hosted on Docker Hub.

“This image has been downloaded over100,000 times, but CrowdStrike Intelligence cannot assess how many of these downloads originate from compromised infrastructure. The Docker image contains a Go-based HTTP benchmarking tool named bombardier…that uses HTTP-based requests to stress-test a website,” the vendor added.

Targeted websites include those in the government, military, media, and retail sectors in both Russia and Belarus. “CrowdStrike Intelligence assesses the activity deploying this Docker image as very likely automated based on closely overlapping timelines in the interaction with the Docker API,” CrowdStrike said.

The second Docker image used in the attack has been downloaded over 50,000 times from DockerHub, CrowdStrike continued. “The image contains a custom Go-based DoS program named stoppropaganda…that sends HTTP GET requests to a list of target websites that overloads them with requests. Again, the attack focused on websites of the Russian and Belarusian media, government, military, energy, mining, and finance sectors.”