Loading story…
Palo Alto Networks Unit 42 reported on TuxBot v3 Evolution, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across 17 CPU architectures. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and 254 DDoS benchmark reports, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with 1,496 credentials, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping.
The report said the framework appears to have been developed with heavy LLM assistance, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake Argon2id routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at 209.182.237[.]133 and a dropper at 185.10.68[.]127, with reported ties to the Keksec/Kaitori and AISURU ecosystems.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Public and internal telemetry tied TuxBot v3 malware to active infrastructure, including a command-and-control server at 209.182.237[.]133 and a dropper at 185.10.68[.]127. The report also noted links between the framework and the Keksec/Kaitori and AISURU ecosystems.
Unit 42 reported recovering the full TuxBot v3 source code, compiled binaries, Docker-based test infrastructure, and 254 DDoS benchmark reports. The recovered materials indicate the botnet framework was under active development and testing through early 2026.
On its publication date, Unit 42 published an analysis of TuxBot v3 Evolution, describing it as a previously undocumented modular IoT botnet framework with working infection, persistence, encrypted C2, and DDoS capabilities across 17 CPU architectures. The report also highlighted multiple implementation flaws consistent with heavy LLM-assisted development.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SophosLabs reported a Linux botnet dubbed **Chalubo** that compromises Internet-facing SSH servers through brute-force credential attacks and can also run on IoT hardware across multiple CPU architectures. The malware uses a layered infection chain in which a downloader establishes persistence, disguises its process name, retrieves an encrypted and LZMA-compressed payload, and launches the main bot; later campaigns also used the **Elknot** dropper. Researchers said Chalubo encrypts both its core bot and Lua-based command scripts with the **ChaCha** stream cipher and includes anti-analysis features more commonly associated with Windows malware. The botnet was built to conduct distributed denial-of-service activity, with Lua scripts enabling **DNS**, **UDP**, and **SYN flood** attacks. Sophos observed one command directing infected systems to launch a SYN flood against IP address `59.56.76.41` on port `10100`, while excluding several hardcoded addresses from targeting. Although the malware shares some code with **Xor.DDoS** and **Mirai**, researchers assessed it as a distinct family and urged defenders to harden SSH access, replace default credentials, and monitor suspicious outbound traffic to TCP port `8852`.
Jun 29, 2026
Researchers reported a previously undocumented Linux botnet dubbed **SSHStalker** that has compromised roughly **7,000** systems by combining **SSH credential brute-forcing/scanning** with **legacy (circa-2009) exploit chains** and highly automated staging. The activity was observed over multiple weeks via SSH honeypots, with intrusions characterized by rapid deployment, on-host compilation, and automated enrollment into command infrastructure, indicating an operation optimized for mass compromise rather than targeted intrusion. SSHStalker uses **IRC-based command-and-control** and a mixed toolkit that includes C-based bots, Perl scripts, and known botnet malware families such as **Tsunami** and **Keiten**. Reporting highlighted an unusual “**dormant persistence**” pattern: infected hosts are kept under control without immediate visible monetization or impact operations, despite having capabilities associated with **DDoS** and **cryptomining**. Persistence is described as noisy but effective, including **cron-based relaunch** behavior that can restore the malware within about a minute after disruption, suggesting the operator may be staging infrastructure or retaining access for future use.
Jun 29, 2026
Researchers reported that the **Masjesu** botnet, also tracked as **XorBot**, has been operating since early 2023 as a **DDoS-for-hire** service promoted on Telegram. The malware targets internet-exposed routers, gateways, cameras, DVRs, NVRs, and other embedded devices across multiple CPU architectures, exploiting known command-injection and remote code execution flaws in products from vendors including **D-Link, Huawei, NETGEAR, TP-Link, and GPON**. Trellix said the botnet is engineered for stealth and longevity, using XOR-based obfuscation, runtime decryption, persistence mechanisms, process spoofing, and multi-domain command-and-control infrastructure with fallback IPs. Once installed, Masjesu opens a hard-coded TCP port `55988` for direct operator access, suppresses termination signals, kills utilities such as `wget` and `curl`, and connects to external servers for attack instructions. The operators reportedly avoid scanning or infecting high-profile ranges such as **U.S. Department of Defense** networks to reduce scrutiny, while advertising the botnet's geographic spread and attack capacity. Observed traffic has been concentrated in **Vietnam** and also seen from **Ukraine, Iran, Brazil, Kenya, and India**, with the botnet used to launch **TCP, UDP, and HTTP flood** attacks against CDNs, game servers, and enterprises, including volumes reported at roughly **290 Gbps**.
Jun 29, 2026