Loading story…
Sophos reported that the Chalubo botnet is infecting exposed Linux servers and IoT devices and repurposing them for distributed denial-of-service operations. The malware was observed targeting internet-facing systems, using compromised devices as part of a broader botnet capable of launching disruptive traffic floods against downstream victims.
The activity highlights continued risk from poorly secured embedded devices and servers that can be silently enrolled into attack infrastructure. By abusing both enterprise and consumer-connected systems, Chalubo expands the pool of available bots and increases the scale and resilience of DDoS campaigns launched from compromised hosts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos published a report describing the Chalubo botnet as malware targeting servers and IoT devices for distributed denial-of-service activity.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SophosLabs reported a Linux botnet dubbed **Chalubo** that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the **Elknot** dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the **ChaCha** stream cipher and includes anti-analysis features more commonly associated with Windows malware. The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling **DNS**, **UDP**, and **SYN flood** attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address `59.56.76.41` on port `10100`, while excluding several hardcoded addresses from targeting. Although the malware shares some code with **Xor.DDoS** and **Mirai**, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port `8852`.
Jun 29, 2026
Darktrace reported a new **Chaos** malware variant compromising misconfigured Linux cloud servers after observing an intrusion through its CloudyPots honeypot network. In the incident, attackers abused an exposed Apache Hadoop application-creation or resource-manager endpoint to achieve remote command execution, then downloaded a 64-bit Linux ELF payload from `pan.tenire[.]com`, changed its permissions, executed it, and removed it from disk. The activity marks an expansion for the Go-based malware family, which had previously been associated mainly with routers, edge devices, DDoS operations, cryptomining, SSH brute-forcing, and exploitation of known vulnerabilities. The updated sample retained persistence and multi-protocol **DDoS** functionality while adding a **SOCKS5 proxy** capability that could relay attacker traffic and support internal network pivoting. Darktrace said some older spreading and exploitation features appear to have been removed, suggesting a shift toward proxy-enabled botnet operations rather than broader self-propagation. The malware used `gmserver.osfc[.]org[.]cn` to resolve command-and-control infrastructure and communicated over port `65111`; researchers also noted Chinese-language strings, `zh-CN` locale indicators, and infrastructure overlap with a ValleyRAT campaign, although they said any attribution to a Chinese threat actor remains circumstantial.
Jun 29, 2026
**RondoDox** has expanded into a large-scale botnet campaign that targets **174 vulnerabilities** across a wide range of internet-exposed devices, with researchers observing up to **15,000 daily exploitation attempts**. Reporting based on **Bitsight** telemetry says the botnet, active since 2025 and built on a **Mirai** code base, is more focused than typical Mirai-derived operations: it is geared toward **denial-of-service activity** and supports **18 architectures**, enabling attacks against routers, DVRs, NVRs, CCTV systems, web servers, and other embedded or Linux-based hardware. Analysts mapped **148 exploits to CVEs**, identified **15 public PoCs without CVEs**, and found **11 exploits with no public PoC**, indicating active exploit collection and rapid weaponization of newly disclosed flaws. The campaign has evolved from earlier exploitation of **TP-Link Archer AX21** flaw `CVE-2023-1389` and later abuse of `CVE-2024-3721`, `CVE-2024-12856`, and the **React2Shell** issue `CVE-2025-55182` affecting **Next.js** servers. Researchers also reported that the operators use **residential IP infrastructure** and traffic patterns that mimic gaming or VPN services to reduce detection, while showing the ability to deploy some exploits within days of disclosure and, in at least one case, exploit `CVE-2025-62593` before its CVE record was formally published. This activity reflects a sustained, strategically managed botnet operation rather than opportunistic scanning, with broad exploit coverage and infrastructure choices designed to improve reach and resilience.
Jun 29, 2026