H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Doki](https://attack.mitre.org/software/S0600) is a backdoor that uses a unique Dogecoin-based Domain Generation Algorithm and was first observed in July 2020. [Doki](https://attack.mitre.org/software/S0600) was used in conjunction with the [ngrok](https://attack.mitre.org/software/S0508) Mining Botnet in a campaign that targeted Docker servers in cloud platforms. (Citation: Intezer Doki July 20)

Labels

malware

14 recorded

Relationships

uses

to Asymmetric Cryptography

Technique

uses

to Automated Exfiltration

Technique

uses

to Deploy Container

Technique

uses

to Domain Generation Algorithms

Technique

uses

to Escape to Host

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Process Discovery

Technique

uses

Technique

uses

to Web Protocols

Technique

uses

Technique

2 external

References

mitre-attack

S0600

Intezer Doki July 20

https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/