New XorDDoS Variant Targets Docker, Linux, IoT in Alarming Expansion

Summary

• The Re-Emergence: XorDDoS, a long-running Linux botnet malware, remains active and keeps evolving.
• Target Expansion: Cisco Talos reported in 2025 that attackers keep hunting for exposed Linux systems, with most observed targets in the United States.
• Technical Insights: The malware hides itself and resists removal.
• Key Players: Security researchers track the botnet and share their findings.
• Recommendations: Strong passwords, patching and monitoring are the main defenses.

Expanding Threat Landscape: XorDDoS Evolves

XorDDoS, malware known for attacking Linux systems since at least 2014, is still spreading and evolving. Infected machines are used to launch distributed denial-of-service (DDoS) attacks. Researchers say it targets Linux servers, including Docker hosts, along with IoT devices.

Understanding the New Variant

In an April 2025 report, Cisco Talos said the attackers mainly break in by brute-forcing SSH passwords on internet-facing Linux systems. Talos also found a new version of the XorDDoS controller being used by operators. Docker servers and IoT devices are attractive because they are common and often poorly secured.

Technical Tactics

XorDDoS uses XOR-based encryption to hide its configuration and communications, which is where it gets its name. It also uses rootkit-style tricks and persistence mechanisms to hide on infected systems and survive reboots. That makes it harder to find and remove with ordinary tools.

Key Players in the Cybersecurity Battle

Security firms have studied XorDDoS for years. Microsoft warned in 2022 that its activity had grown sharply, and Talos has tracked newer campaigns. Their research helps defenders spot and block the malware.

Collaborative Defense

Researchers share threat intelligence to map the botnet’s servers, track which IP addresses are scanning for weak SSH logins, and publish indicators that defenders around the world can load into their firewalls and detection tools the same day. That helps.

Security Recommendations

Experts recommend these steps:

• Regular Updates: Keep all systems, including Docker hosts and IoT devices, patched.
• Network Monitoring: Watch for unusual or unauthorized activity.
• Access Control: Use strong passwords or SSH keys, disable password logins where possible and limit who can reach critical systems.
• Employee Training: Teach staff to spot suspicious activity.

The Takeaway

XorDDoS is old. It still works. Organizations need good tools and a security-aware culture. Basic controls stop many of these attacks. Start there.

Sharing knowledge across the security community remains one of the best defenses against botnets like this.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.