Loading story…
SophosLabs reported a Linux botnet dubbed Chalubo that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the Elknot dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the ChaCha stream cipher and includes anti-analysis features more commonly associated with Windows malware.
The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling DNS, UDP, and SYN flood attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address 59.56.76.41 on port 10100, while excluding several hardcoded addresses from targeting. Although the malware shares some code with Xor.DDoS and Mirai, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port 8852.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
SophosLabs published research on a newly discovered Linux denial-of-service bot family named Chalubo, describing its layered infection chain, ChaCha-encrypted payloads and Lua scripts, and anti-analysis techniques. The report also noted code overlap with Xor.DDoS and Mirai but assessed Chalubo as a distinct malware family.
SophosLabs said that in later campaigns, operators used the Elknot dropper to deliver the Chalubo malware package. This reflected an evolution in the infection chain beyond the original downloader-based delivery.
SophosLabs reported that the Linux DDoS bot family Chalubo had been targeting Internet-facing SSH servers via brute-force credential attacks since late August and early September 2018. The activity marked the start of the observed Chalubo campaign.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that the **Chalubo** botnet is infecting exposed Linux servers and IoT devices and repurposing them for distributed denial-of-service operations. The malware was observed targeting internet-facing systems, using compromised devices as part of a broader botnet capable of launching disruptive traffic floods against downstream victims. The activity highlights continued risk from poorly secured embedded devices and servers that can be silently enrolled into attack infrastructure. By abusing both enterprise and consumer-connected systems, Chalubo expands the pool of available bots and increases the scale and resilience of DDoS campaigns launched from compromised hosts.
Jul 12, 2026
Researchers reported a previously undocumented Linux botnet dubbed **SSHStalker** that has compromised roughly **7,000** systems by combining **SSH credential brute-forcing/scanning** with **legacy (circa-2009) exploit chains** and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion. SSHStalker uses **IRC-based command-and-control** and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as **Tsunami** and **Keiten**. Reporting highlighted an unusual “**dormant persistence**” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with **DDoS** and **cryptomining**. Persistence is described as noisy but effective, including **cron-based relaunch** behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Jun 29, 2026
Palo Alto Networks Unit 42 reported on **TuxBot v3 Evolution**, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across **17 CPU architectures**. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and **254 DDoS benchmark reports**, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with **1,496 credentials**, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping. The report said the framework appears to have been developed with heavy **LLM assistance**, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake `Argon2id` routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at `209.182.237[.]133` and a dropper at `185.10.68[.]127`, with reported ties to the **Keksec/Kaitori** and **AISURU** ecosystems.
Jul 15, 2026