Tsunami

Tsunami is a Linux malware family and IRC-controlled bot/backdoor widely associated with distributed denial-of-service (DDoS) activity and remote control of compromised systems. The content describes it as a Linux-based malware used primarily for DDoS attacks, with backdoor capabilities, and notes that it communicates over Internet Relay Chat (IRC) as its command-and-control channel. It has been referred to in detections and reporting as Tsunami/Kaiten, Kaiten, Keiten, and TsunamiKit in some contexts.

The malware has been observed on both IoT/embedded Linux devices and traditional Linux servers. Reporting in the content states that, unlike some IoT DDoS bots, Tsunami is distributed not only to IoT devices but also to Linux servers. It appears in multiple Linux intrusion chains involving brute-force attacks against SSH services, exploitation of public vulnerabilities, and post-exploitation payload deployment. Specific delivery contexts mentioned include Shellshock exploitation, Log4Shell-related botnet activity through the Muhstik variant, exploitation of Oracle WebLogic and Confluence vulnerabilities by the 8220 gang, and malicious VS Code repository/task abuse in the DPRK-linked Contagious Interview campaign where a Tsunami/TsunamiKit backdoor was deployed alongside XMRig.

Capabilities directly described in the content include IRC-based command reception, remote access/backdoor functionality, and DDoS attack execution. One Shellshock-delivered sample was an x86_64 ELF executable (MD5: aec2df8a6cb35aa5b01b0d9f1f879aa1) detected by many vendors as Tsunami/Kaiten; it functioned mainly as a DDoS client but also had backdoor capabilities and connected over IRC to 104.192.103.6. Another description states that a downloaded bashirc payload identified as Tsunami acted as a Linux backdoor allowing remote access while using IRC control as a client for DDoS attacks. In 8220-related activity, Tsunami payloads were identified by MD5 hashes 63a86932a5bad5da32ebd1689aa814b3 and 0ba9e6dcfc7451e386704b2846b7e440.

The content links Tsunami to several threat ecosystems and derivative malware. Remaiten was described as combining features of Tsunami and LizardStresser/Torlus. Muhstik was described as a Tsunami variant that borrows from Mirai code and, in one observed Log4j exploitation wave, added an ldm module that installed an SSH authorized_keys backdoor. SSHStalker was reported to use classic IRC botnet mechanics and to include known malware families such as Tsunami and Keiten in its toolkit. Rapper Bot’s alleged developer stated its code was derived from Mirai, Tsunami, and fBot. The China-linked 8220/Water Sigbin cryptomining operation used K4Spreader/Hadooken to deploy Tsunami together with mining payloads such as PwnRig/XMRig-derived miners.

Industries and victim environments mentioned in connection with Tsunami-related activity include cloud hosting environments, Linux SSH servers, routers and IoT devices, cryptocurrency/fintech/blockchain software engineers, and vulnerable enterprise applications such as WebLogic and Confluence servers. High-confidence indicators explicitly mentioned in the content include MD5 hashes aec2df8a6cb35aa5b01b0d9f1f879aa1, 63a86932a5bad5da32ebd1689aa814b3, and 0ba9e6dcfc7451e386704b2846b7e440; IRC/C2 infrastructure including 104.192.103.6, c4k-ircd.pwndns.pw, pwn.oracleservice.top, and 51.255.171.23; and one reported IRC configuration using channel #.br with password ircbot456@. ClamAV detections cited include Unix.Malware.Tsunami and Unix.Malware.Tsunami-9915807-0.