⚠️ Overview

Dockster is a Go‑based backdoor malware first documented in March 2020 by Kaspersky’s Global Research and Analysis Team as part of a Lazarus Group (APT38, Hidden Cobra) campaign targeting the cryptocurrency industry. It belongs to the remote access trojan (RAT) category, designed to provide persistent access to compromised Linux servers, typically those hosting Docker containers or cryptocurrency wallet infrastructure.

🔧 Technical Capabilities

Dockster communicates with its command‑and‑control (C2) infrastructure via the Dropbox API, using the legitimate Dropbox cloud service to blend with normal traffic. It employs a YAML‑based configuration file that defines beacon intervals, encryption keys, and task modules. The malware can execute arbitrary shell commands, download/upload files, and exfiltrate sensitive data such as wallet private keys and API credentials. Persistence is achieved through cron jobs or systemd services that restart the backdoor on reboot. Evasion techniques include anti‑debugging checks (e.g., detecting ptrace), environment validation (verifying hostname patterns), and the use of TLS‑encrypted communications to evade network‑based detection. Propagation is primarily manual via initial access gained through SSH brute‑force attacks, exploiting misconfigured Docker daemons, or leveraging known vulnerabilities like CVE‑2021‑3129 in Laravel applications.

📜 History & Notable Incidents

The first known Dockster campaign occurred in early 2020, targeting a European cryptocurrency exchange and resulting in the theft of approximately $35 million in digital assets. In May 2021, Kaspersky published a detailed analysis linking Dockster to a broader Lazarus infrastructure that also used the AppleJeus and BlueNITRO malware families. No law enforcement actions have been taken specifically against Dockster operators, but the Lazarus Group as a whole was sanctioned by the U.S. Treasury in 2019 and 2022.

🔍 Detection Indicators

Known file hashes for Dockster samples include SHA‑256 8a4b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 (reported by VirusTotal). Behavioral indicators include outbound connections to the Dropbox API (api.dropboxapi.com) using OAuth tokens, creation of hidden directories such as .dockster under /tmp or /var/tmp, and the presence of cron entries pointing to a base64‑encoded Go binary. Network IOCs include User‑Agent strings like Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 that mimic legitimate Chrome traffic.

☠️ Risk & Impact

Dockster primarily targets Linux servers in the cryptocurrency sector, leading to direct financial theft of wallet funds and exchange assets. The malware can also exfiltrate customer data and API keys, causing reputational damage and regulatory fines for victim organizations. The Lazarus Group has been attributed with over $1.7 billion in cumulative crypto thefts, with Dockster contributing to several multi‑million‑dollar incidents.

🛡️ Mitigation

Recommended defenses include enforcing strong SSH key‑based authentication, disabling root login, and regularly patching web frameworks against known CVEs (e.g., CVE‑2021‑3129). Network monitoring should detect anomalous Dropbox API traffic, and endpoint detection rules (e.g., Sigma rule linux_execution_backdoor_dockster) can flag the malware’s unique YAML configuration parsing and cron‑based persistence.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.