tuxnokill
tuxnokill is a Mirai-based botnet malware variant documented by Akamai in 2026. It was observed being installed via a shell script named dlink.sh after exploitation of CVE-2025-29635, a command-injection vulnerability in D-Link DIR-823X routers through the /goform/set_prohibiting endpoint. Akamai reported this as the first observed in-the-wild exploitation of that flaw and linked the same threat actor to similar Mirai deployment activity exploiting CVE-2023-1389 in TP-Link routers and a remote code execution flaw in ZTE ZXV10 H108L routers. The malware supports multiple architectures and includes Mirai-style DDoS capabilities, including TCP SYN, TCP ACK, TCP STOMP, UDP flood, and HTTP null attacks. Researchers also noted the hard-coded string "AI.NEEDS.TO.DIE" in the malware. The campaign targets vulnerable and end-of-life IoT/network devices, particularly unsupported routers, to conscript them into a botnet. High-confidence infection details include crafted POST requests, download and execution of dlink.sh from an external IP, and subsequent installation of the tuxnokill payload.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Researchers have uncovered an active Mirai botnet campaign exploiting CVE-2025-29635, a command-injection vulnerability in legacy D-Link DIR-823X routers, to recruit internet-exposed devices into a distributed denial-of-service (DDoS) botnet.
The script installs a Mirai-based malware named "tuxnokill," which supports multiple architectures.
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
CVE-2025-29635 (CVSS score: 7.5) - A command injection vulnerability in end-of-life D-Link DIR-823X series routers that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function.
Stealth
2 techniques
Stealth
Discovery
1 technique
Discovery
Command and Control
2 techniques
Command and Control
[Router Connects to C2 at 64.89.161[.]130:44300]-> [Mirai Botnet Receives DDoS Commands]
After successful command injection, the attacker downloads a shell script named dlink.sh. The downloader infrastructure was observed hosted at 88.214.20[.]14. Multiple fallback methods such as busybox wget, curl, wget, tftp, and ftpget are used to ensure payload delivery.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newly discovered Mirai botnet variant targeting vulnerable IoT devices, spreading via command injection in D-Link routers and also observed alongside probing of TP-Link and ZTE devices. It is used to compromise devices for botnet activity and DDoS operations.
A Mirai-based malware variant deployed via shell script on vulnerable routers, supporting multiple architectures and providing standard Mirai DDoS capabilities such as TCP SYN/ACK/STOMP, UDP floods, and HTTP null.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.