Get Boated: Docker-Delivered Mirai-Linked Malware With EtherHiding C2

One address delivered Boatnet three ways

85[.]137[.]54[.]178 was the source of SSH, Docker, and n8n activity between the 13th and 21st of September 2026. During the Docker phase, the source sent 3,761 API requests, including 578 container-creation requests and 295 archive uploads, and rotated through six packed Boatnet builds. The source also served the payloads over HTTP and HTTPS and was Boatnet's primary C2 on TCP/443.

Captured requests show three phases: URL-based downloads into host-mounted /dev/shm; delivery to host /var/cache/.dk with host-binary download fallbacks; then Docker archive uploads of .dkprobe write/read probes and packed Boatnet .dk ELFs, with setsid execution requests for container-local /tmp/.dk. Every captured execution command specified 应用-docker.

Six packed builds shared one suffix

All six packed builds shared the 16-byte suffix BN4/mG7otq7uVCjF. Removing it allowed UPX unpacking. Every unpacked image contained # boatnet-unit-v2, the same Polygon smart contract (0x5D5abC33a4e5C602a002815d93806b204324D1a1), three RPC providers, and systemd service references. VirusTotal labels the original and final builds as Linux DDoS malware, two of the three samples as Mirai.

Polygon contract rotated the C2 list

Boatnet's native Linux build 6 invokes EtherHiding when its configured C2 address is zero, reading an AES-128-GCM-encrypted C2 list from an owner-updatable Polygon contract through public RPC providers. The contract controller deployed the contract five hours before the Docker activity. After the Docker activity ended, the contract controller rewrote the C2 list five times, rotating secondary endpoints on port 18082 in China (1[.]13[.]185[.]53, 36[.]138[.]220[.]98), Germany (164[.]68[.]109[.]244), and the Netherlands (80[.]87[.]206[.]86).

The source returned for n8n

Three days after the Docker campaign, the same source returned and targeted n8n on port 5678 with CVE-2026-21858 file-read attempts (files.filepath=/etc/passwd). The twelve file-read POST requests received 404 responses.

Defender-visible markers

Search for the six packed hashes, the BN4/mG7otq7uVCjF suffix, /dev/shm/b1, /var/cache/.dk, /tmp/.dkprobe, hidden files under /etc, /var/cache, /var/lib, /usr/bin, and ~/.cache containing the packed-build marker, and host-namespace userland processes named kworker/1:1 whose parent PID isn't 2. The Full Report provides two YARA rules, two Suricata signatures, and host hunt commands.