Hajime

Hajime is a Linux-based IoT malware family and worm first publicly reported in October 2016 that builds a large peer-to-peer botnet targeting internet-connected embedded devices such as routers, DVRs, cameras, and other IoT systems. It is written in C and has been described as more advanced than Mirai in some reporting, while using propagation methods similar to Mirai but differing architecturally through decentralized peer-to-peer communications. Multiple reports state Hajime lacked denial-of-service modules and was primarily focused on propagation and botnet growth rather than observed DDoS activity. Researchers also noted similarities to Linux.Wifatch because Hajime appeared to attempt to secure infected devices and left messages on compromised systems including: "Just a white hat, securing some systems." and "Important messages will be signed like this! Hajime Author. Contact CLOSED Stay sharp!"

High-confidence propagation methods mentioned in the content include Telnet default-password attacks, targeted brute-forcing based on device banners, an Arris cable modem password-of-the-day attack, exploitation of TR-069 via the NewNTPServer feature to achieve command execution, exploitation of GPON router vulnerabilities CVE-2018-10561 and CVE-2018-10562, exploitation of MikroTik Chimay Red / CVE-2017-20149, and association with exploitation of Xiongmai CVE-2018-10088. The malware used architecture detection during Telnet compromises and patched downloader binaries on the fly with host, port, and WAN interface information before execution. Researchers reported hand-written assembly code for several platforms, indicating a comparatively sophisticated implementation.

Victimology in the provided content indicates Hajime infected hundreds of thousands of IoT devices worldwide, with reports citing roughly 297,499 to 300,000 compromised devices. The most affected countries mentioned include Iran, Brazil, Vietnam, Russia, Turkey, India, Pakistan, Italy, and Taiwan. Honeypot and HTTP header observations indicated many infected systems were DVRs, web cameras, routers, and similar embedded Linux devices.

The malware is associated with the Hajime botnet and has been characterized in some reporting as a vigilante or white-hat botnet because of its messaging and apparent device-securing behavior, although its ultimate purpose was described as unknown. Kaspersky detected it as Backdoor.Linux.Hajime. The content also notes Hajime activity or infrastructure in later datasets, including association with 191 C2 servers in one Hunt.io dataset and continued mention alongside other IoT botnets such as Mirai, Mozi, Satori, and BotenaGo.