Doki

Executive Summary

Doki is a Linux‑native backdoor that targets Docker containers in cloud environments, using a Dogecoin‑based DGA to evade detection. It establishes remote shells and may perform cryptocurrency mining on victim hosts.

Doki is a sophisticated Linux‑based backdoor that has been active since at least July 2020. It was discovered in association with the “ngrok Mining Botnet” and primarily targets Docker containers deployed on cloud platforms such as AWS, GCP, or Azure. The malware’s command‑and‑control (C2) infrastructure relies on a unique Dogecoin‑style Domain Generation Algorithm (DGA), which continuously produces new domain names that mimic cryptocurrency‑related traffic to evade detection. Once inside a container, Doki establishes persistence by creating system services and modifies startup scripts so it is automatically launched with each reboot. The backdoor exposes an interactive shell—often via TCP or SSH proxies—allowing adversaries to execute arbitrary commands, exfiltrate data, and download additional payloads. Its integration with ngrok channels also permits the malware to tunnel traffic through legitimate cloud services, further obscuring its presence. Beyond remote control, Doki is believed to conduct lightweight cryptocurrency mining, exploiting CPU resources of compromised containers for Dogecoin or similar altcoins. This dual function—command execution coupled with mining—extends its value chain: it can remain undetected while generating revenue and simultaneously provide a foothold for other attacks within the same environment.

Key Capabilities

• Creates persistence via systemd services and startup scripts
• Establishes an interactive shell for remote command execution
• Uses a unique Dogecoin‑based domain generation algorithm to contact its C2 infrastructure
• Targets Linux containers running in cloud platforms (AWS, GCP, Azure)
• Can download and execute additional payloads
• May perform lightweight cryptocurrency mining on compromised hosts

ATT&CK Techniques

Recommended Actions

• Implement network segmentation to isolate container ecosystems from core IT networks
• Deploy runtime security solutions that detect anomalous outbound DNS queries, especially those following DGA patterns
• Enable container image whitelisting and provenance checks for all Docker images
• Monitor system processes for persistent services unrelated to legitimate workloads
• Block suspicious domains identified as part of the Dogecoin DGA set via threat feeds or internal analysis
• Apply timely OS and kernel patches on all Linux hosts and containers

Suggested Tags