Threat Research · unit42.paloaltonetworks.com

TuxBot v3 IoT Botnet Shows Signs of LLM-Assisted Development

Jul 15, 2026 · Original article ↗

Summary

Researchers analyzed TuxBot v3 Evolution, an IoT botnet with working brute-force and DDoS capabilities. Recovered code suggests LLM-assisted development, while implementation bugs disable several exploit and fallback command channels.

Key points

Researchers recovered source code, multi-architecture binaries and automated DDoS test reports; samples appeared in telemetry through April 2026.
The bot uses 1,496 Telnet credential pairs and supports encrypted primary command-and-control, persistence and network-flood attacks.
A mismatched XOR key breaks several exploit payloads and the IRC and HTTP fallback channels; incompatible file formats prevent the exploit virtual machine from loading its package.
The Go-based control server provides an SSH panel for DDoS operators, while the build system produces binaries for 17 architectures.
Comments and authentication code led researchers to conclude that an LLM assisted development; one password-hashing implementation is labeled Argon2id but uses SHA256 loops instead.
Shared dropper infrastructure and a TLS certificate link TuxBot infrastructure to Kaitori and AISURU tooling, according to the researchers.
Researchers repaired selected defects during analysis, but a corrected production version remains an inference rather than a confirmed finding.

Article Details

Attack Vectors: TuxBot uses 1,496 credential pairs to brute-force Telnet access on IoT devices.
The HTTP scanner probes random public IP addresses and administrative endpoints using hard-coded credentials, but its propagation logic is incomplete.
The framework includes functional SSH and ADB scanners. Its broader exploit engine and exploit VM do not execute successfully in the analyzed version.
Infected devices receive commands over an encrypted TCP C2 channel and can conduct UDP, TCP and DNS floods.
Defensive Notes: The bot establishes persistence through a disguised systemd service, cron entries and shell profile modifications.
It masquerades as system daemons, relocates its binary and checks for virtualized or analysis environments.
IRC and HTTP fallback C2 are broken in the analyzed samples; DNS TXT, DGA and P2P fallback mechanisms are reported as functional.
The historical Tsunami dropper at 188.166.2[.]226 now serves a legitimate platform; the source warns that blocking it will affect legitimate services.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`jetross[.]com`	Domain on a TLS certificate observed on both the TuxBot C2 and dropper servers.
IPV4	`107[.]174[.]133[.]119`	Keksec dropper associated with a Huawei exploit payload.
IPV4	`154[.]6[.]197[.]43`	Address in the bot source to which successful Telnet logins are reported.
IPV4	`185[.]10[.]68[.]127`	Dropper server used for TuxBot and Kaitori payloads.
IPV4	`194[.]46[.]59[.]169`	AISURU infrastructure contacted by a sample that also communicates with the shared dropper.
IPV4	`209[.]182[.]237[.]133`	TuxBot primary C2 server hosting the bot protocol, operator panel and machine API.
IPV4	`45[.]145[.]185[.]229`	Keksec dropper identified in the related ecosystem.
SHA256	`0f8bcca3ed65e980da2a1f90a767b7d543be32eeea3e9338d09d4d635a497988`	Compiled TuxBot MIPS binary.
SHA256	`146f6010f6ee082aab13e0148d39baefa77eaba4ff65817b511b08c2092bdfd2`	Compiled TuxBot ARM binary.
SHA256	`15c17dce89deccd5172285b2650de957918aa1157cde8e4633ae15dfe31f2711`	Compiled TuxBot x86-64 binary.
SHA256	`246c97957651de568e61eba1abe572f0b0f960456209995d43d53a0d7cc494a1`	Compiled TuxBot MIPS little-endian binary.
SHA256	`2f2c3551762c03da126e45dca6fc2f997c63f0f1bfc21fd0ceed680ac6f083ce`	Compiled TuxBot PowerPC 64-bit little-endian binary.
SHA256	`3ec016d637e4c9cd331edd2580a229621ad638e924a4aa29ac0342e9144ace19`	Compiled TuxBot PowerPC binary.
SHA256	`511d3ffb4091cbcc94571d9fb3102e8cb424c6e187d01d53ff12078d54929bda`	Confirmed TuxBot ARM sample from internal telemetry.
SHA256	`6aa4034dc7a2858094ff4dc59af07d6fe31119591e41599bcc0f3d0b516ee734`	Confirmed TuxBot ARM sample from internal telemetry.
SHA256	`6b7a8e0c96c2318e747f074f9a99d26738700769ac01bba692d19fc884847737`	Compiled TuxBot Alpha binary.
SHA256	`71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d`	Confirmed TuxBot x86-64 debug sample.
SHA256	`96b1f96efca3b9df2dea85678d60da27e3265b4a00e39e20e64b27bb985e1561`	Compiled TuxBot MIPS64 binary.
SHA256	`9cd5e7e3c8bad321ef6c3d47fe25b3b56e9487f703a7eeee52db4067e6bafe61`	Compiled TuxBot RISC-V binary.
SHA256	`a03b0d41f5ef03328150331ffa0ed970998883f7e0343d79b2d3b95330d8e7c1`	Compiled TuxBot ARM7 binary.
SHA256	`a8d70d16509e227d8306be361bc37a3dc9fe34bf476f51e361e55e6d293c2b3f`	Compiled TuxBot m68k binary.
SHA256	`bd6431fb06e4689142ef597cf00382e38ae20a5393a4d9277e45a3f5b3cbcff9`	Compiled TuxBot ARM64 binary.
SHA256	`c7a36d6b8128c41f93a32413675401a10a2b5769b221bbaa8c5c309585b73ceb`	Compiled TuxBot MIPS64 little-endian binary.
SHA256	`e3a5296e762e9ee16010399666441d663beeea956382e97cca032a6a5ad06811`	Compiled TuxBot S/390 binary.
SHA256	`eb2fa179fde2f097c18d5d700ad87d660fc238ee14cbe5477032e60856859621`	Compiled TuxBot PA-RISC binary.
SHA256	`f1efb78887bb8783d7781c07cd13b53c9c79ebe5baa81f335838d0a6e73dec7e`	Compiled TuxBot SH4 binary.
SHA256	`f324a45fcd2a9db4e542c09486c21b08bc42d6bf76fbd5f17871090361b10815`	Compiled TuxBot SPARC64 binary.