Security researchers have uncovered TuxBot v3 Evolution, a modular IoT botnet framework built to compromise internet-exposed devices, maintain long-term access, and launch distributed denial-of-service (DDoS) attacks.
The malware targets a broad range of Linux-based systems and uses Telnet credential brute forcing, scanning modules, encrypted command-and-control (C2), and multiple resilience features
The botnet carries 1,496 username-and-password pairs aimed at devices still using factory or commonly reused credentials.
Its Telnet scanner is operational and can attempt logins against exposed systems, making poorly secured routers, DVRs, cameras, and other IoT products a key risk.
TuxBot was compiled for 17 processor architectures, including ARM, MIPS, x86-64, PowerPC, RISC-V, SPARC, and others.
This broad architecture support allows attackers to deploy the same framework across diverse embedded devices and Linux environments.
The bot identifies itself on compromised systems by displaying the message “Infected By Akiru.” Researchers found samples submitted to VirusTotal in January 2026 and later detected multiple production builds across different architectures.
Botnet Exploits Default Passwords
After execution, TuxBot attempts to hide its process, establish persistence, initiate scanning, and connect to its operator-controlled infrastructure.
It uses seven persistence approaches: a disguised systemd service, cron jobs, shell-profile modification, hidden backups, a guardian process, watchdog keepalive activity, and regular relocation of the binary across directories.
The systemd service is configured as sd-pam.service, helping it blend in with legitimate Linux service activity.
The malware can also inject commands into .bashrc, .profile, and .zshrc, while copying itself to hidden locations and using dot-prefixed filenames to reduce visibility.
For stealth, the bot may impersonate one of 20 common daemon names, including systemd-udevd, dbus-daemon, cron, and sshd.
It also includes anti-analysis checks for virtual machines, debuggers, reverse-engineering tools, packet-analysis software, and forensic utilities.
TuxBot’s primary C2 channel uses encrypted TCP communications on port 1999 or 31337, depending on the build.
The protocol uses X25519 key exchange and ChaCha20-Poly1305 encryption, while packets include a 0xDEADBEEF magic value, nonce, ciphertext, and authentication tag.
The framework also includes fallback C2 channels using a SHA-512 domain generation algorithm (DGA), DNS TXT queries, peer-to-peer gossip, IRC, and HTTP polling.
In the analyzed version, the DGA, DNS, and peer-to-peer mechanisms worked, but the IRC and HTTP fallback channels were broken because of an XOR encryption-key mismatch.
TuxBot also contains code for application-layer attacks, such as HTTP GET floods, POST floods, Slowloris, Apache Range attacks, WordPress XML-RPC abuse, and Cloudflare-bypass variants.
However, these functions were not correctly connected in the analyzed code, so operators requesting an HTTP attack may instead trigger a TCP SYN flood.
Indicators of Compromise
| IOC type | Indicator | Notes |
|---|---|---|
| Malware family | TuxBot v3 Evolution | Modular IoT botnet framework targeting Linux-based and embedded devices. |
| SHA-256 | 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d | x86-64 debug build first submitted to VirusTotal on January 20, 2026. |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs
