Unit 42 Details TuxBot IoT Botnet’s LLM-Assisted Development and Capabilities
Summary
Unit 42 analyzed TuxBot v3 Evolution, an IoT botnet framework with a multi-architecture agent, Go C2, Telnet brute forcing, IoT exploits, and fallback channels. Researchers found signs of LLM assistance and linked its operator to the Keksec ecosystem.
Key points
- Unit 42 says TuxBot v3 Evolution shows signs of LLM-assisted development; analyzed samples had broken or incomplete features and comments containing raw LLM reasoning.
- The framework includes a multi-architecture C bot agent, Go-based C2 and DDoS-for-hire panel, custom exploit VM, Docker test infrastructure, and automated build system.
- The bot is designed to brute-force Telnet using 1,496 credential pairs and includes exploit code targeting more than 30 IoT device families.
- Its C2 options include encrypted TCP, a SHA512 domain generation algorithm, P2P gossip with Ed25519-signed commands, IRC, DNS TXT queries, and HTTP polling.
- The analyzed framework includes anti-analysis checks, process-name hiding, persistence via systemd and cron, scanners, proxy functionality, and DDoS modules.
- Unit 42 traced code lineage to Mirai, AISURU, Wuhan, and MHDDoS, and said shared infrastructure with Kaitori v3.9 and AISURU tooling places the operator in the Keksec ecosystem.
Article Details
- Attack Vectors
- Brute-force Telnet access on targeted devices using a set of 1,496 credential pairs.
- Exploit code targeting more than 30 IoT device families using known vulnerabilities.
- DDoS attacks launched by botnet modules.
- C2 communication over encrypted TCP, with fallback channels using IRC, DNS TXT queries, HTTP polling, and P2P gossip.
MITRE ATT&CK
T1036 · MasqueradingThe botnet hides its process name after launch.T1053.003 · CronPersistence is established using cron entries.T1057 · Process DiscoveryThe bot checks for running analysis tools during initialization.T1071.001 · Web ProtocolsHTTP polling is used as a fallback C2 mechanism.T1071.003 · Mail ProtocolsIRC is used as a fallback C2 channel.T1071.004 · DNSThe botnet uses DNS TXT queries as a fallback communication mechanism.T1110.001 · Password GuessingThe bot agent brute-forces Telnet access on targeted devices using 1,496 credential pairs.T1210 · Exploitation of Remote ServicesThe bot agent incorporates exploit code targeting known vulnerabilities in more than 30 IoT device families.T1497.001 · System ChecksThe bot checks for analysis tools and uses anti-VM protections.T1498 · Network Denial of ServiceThe botnet includes modules for mounting DDoS attacks.T1543.002 · Systemd ServicePersistence is established using a systemd service.T1573 · Encrypted ChannelBots communicate with the C2 server over an encrypted TCP channel.
People
Threat Actors
Malware
AisuruThe framework combines multi-architecture bot code, a Go-based C2 with a DDoS-for-hire panel, and multiple fallback channels, with links traced to Mirai, AISURU, Wuhan, MHDDoS, and the Keksec ecosystem.MiraiThe framework combines multi-architecture bot code, a Go-based C2 with a DDoS-for-hire panel, and multiple fallback channels, with links traced to Mirai, AISURU, Wuhan, MHDDoS, and the Keksec ecosystem.TuxBot v3 EvolutionResearchers uncovered TuxBot v3 Evolution, a previously unreported IoT botnet framework that appears to have been developed with help from an LLM, though several features were left broken or incomplete.WuhanThe framework combines multi-architecture bot code, a Go-based C2 with a DDoS-for-hire panel, and multiple fallback channels, with links traced to Mirai, AISURU, Wuhan, MHDDoS, and the Keksec ecosystem.