See post at dc864 that describes the proof of concept.
Idea is to use docker hub as a repository to exfiltrate data, using containers. This could be epsecially useful in a devops environment that relies on docker.
Note: this is strictly a Proof-of-concept and has not been seen in the wild to my knowledge. To operationalize this for your red teaming exercise, add your docker hub credentials, create a repository on docker hub (and probably should be private if you are doing this for a client), then unpload the load function onto the victim machine, and the unload function for the attacker machine.
While this started out as a python proof-of-concept for a MITRE ATT&CK specific sub-technique, I’m looking at making this a more robust tool for exfiltration.
With the recent controversies around Golang and google potentially adding telemetry, No to Go; just not within my risk tolerance to also need to keep up with whether Google adds it to Golang or not. Would rather use a project this isn’t considered a worry.