Doki
- ID
- S0600
- Type
- Malware
- Platforms
- Linux, Containers
- Source
- attack.mitre.org
- MITRE last modified
- 25 Apr 2025
Doki is a backdoor that uses a unique Dogecoin-based Domain Generation Algorithm and was first observed in July 2020. Doki was used in conjunction with the ngrok Mining Botnet in a campaign that targeted Docker servers in cloud platforms. [1]
Techniques used (14)
- T1020 Automated Exfiltration
- T1036.005 Match Legitimate Resource Name or Location
- T1041 Exfiltration Over C2 Channel
- T1057 Process Discovery
- T1059.004 Unix Shell
- T1071.001 Web Protocols
- T1083 File and Directory Discovery
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1133 External Remote Services
- T1568.002 Domain Generation Algorithms
- T1573.002 Asymmetric Cryptography
- T1610 Deploy Container
- T1611 Escape to Host