TuxBot v3 IoT Botnet Hijacks Devices, Launches DDoS Attacks with LLM Code

Key Takeaways

• TuxBot v3 Evolution is a newly discovered IoT botnet framework capable of hijacking a wide range of Linux-based devices for DDoS attacks.
• The botnet leverages large language models (LLMs) for code generation, a notable development in malware creation.
• It employs multiple infection vectors, including brute-forcing common credentials and exploiting vulnerabilities.
• Despite incorporating LLM-generated code, which introduced some flaws, TuxBot v3’s core DDoS and persistence functions remain operational.
• The botnet’s infrastructure suggests a DDoS-for-hire model, with connections to other known botnet families.

A sophisticated new Internet of Things (IoT) botnet, dubbed TuxBot v3 Evolution, has emerged, capable of compromising internet-connected devices and conscripting them into a network for launching distributed denial-of-service (DDoS) attacks. This advanced malware framework poses a significant threat to a diverse array of Linux-based equipment, including routers, security cameras, and other exposed devices, due to its broad architectural compatibility.

TuxBot v3 employs various methods to gain unauthorized access. These include brute-forcing Telnet and SSH credentials, conducting HTTP-based reconnaissance, scanning for Android Debug Bridge (ADB) instances, and actively exploiting known vulnerabilities in target devices. Notably, its Telnet module alone contains a dictionary of 1,496 username and password combinations, many of which are default or vendor-specific credentials commonly found on inadequately secured devices.

Analysts at Unit 42 said in a report that TuxBot is a previously undocumented, modular botnet framework. It features an encrypted command channel, a bespoke exploit system, and an infrastructure designed to support “DDoS-for-hire” operations.

A striking aspect of this discovery is the apparent use of large language models (LLMs) in the development of significant portions of the framework. Recovered source code reveals embedded AI safety comments and internal reasoning annotations, indicating that automatically generated code was integrated into the botnet with minimal human oversight.

New TuxBot v3 IoT Botnet Uses LLM-Generated Code

The TuxBot v3 framework is composed of a C-based bot client and a Go-based command-and-control (C2) server. This C2 server possesses the capability to compile payloads for at least 17 distinct processor architectures, enabling operators to generate malware tailored for platforms such as ARM, MIPS, PowerPC, RISC-V, and x86-64 from a unified development environment.

Upon successful infiltration, TuxBot employs multiple techniques to ensure persistence on a compromised device. These include masquerading as a legitimate system service, establishing cron jobs, modifying shell profiles, creating hidden backup copies, implementing watchdog functionalities, and periodically relocating its binary. The botnet can also obscure its process name and actively scan for and remove competing malware infections from the same device, consolidating its control.

The developers of TuxBot borrowed extensively from existing botnet families and the open-source MHDDoS toolkit, a common practice in the IoT threat landscape. This mirrors the pattern seen with Mirai-derived DDoS botnets, which provide a ready-made foundation for new attack tools. However, the reliance on AI-generated code also introduced several critical flaws in the analyzed version. Researchers identified an encryption-key mismatch that rendered multiple functions inoperable, a custom exploit virtual machine incapable of loading its own packages, and an authentication component falsely labeled as Argon2id that lacked actual Argon2id password hashing implementation.

Despite these imperfections, TuxBot’s fundamental capabilities remain a serious threat. Its core functions, including credential brute-forcing, encrypted primary communications, persistence mechanisms, network scanning, and various DDoS attack methods (UDP, TCP, and DNS floods), were fully operational in the samples analyzed. Researchers warn that the availability of the complete source code to the operators means these identified defects could be swiftly addressed.

DDoS Infrastructure and Defense

TuxBot communicates with its C2 server via encrypted TCP channels. Should the primary server become unavailable, the botnet is designed to fall back on domain-generation algorithms and peer-to-peer communication mechanisms. The operator’s C2 server also featured an SSH-accessible panel, allowing users to monitor connected bots and issue attack commands, strongly suggesting a service designed for managed DDoS operations.

Prior to its public appearance, the malware’s developers rigorously tested its attack performance within a Docker-based environment, generating 254 automated benchmark reports. While the framework boasts a wide array of advertised attack options, researchers found that many web-focused methods in the analyzed build were incorrectly routed to simpler TCP SYN floods, rendering some of the more advanced capabilities inactive.

Nevertheless, the active features of TuxBot represent a tangible threat that defenders must take seriously. Researchers have linked TuxBot’s infrastructure to broader activities associated with the Keksec, Kaitori, and AISURU botnet families, based on shared hosting and certificate artifacts. This connection highlights a trend where threat actors reuse infrastructure while maintaining distinct malware codebases and campaigns.

The emergence of TuxBot also underscores a broader evolution in cybercriminal development. While AI assistance can accelerate code generation and cross-platform porting, even when the output is initially unreliable, it echoes growing concerns about the potential for LLM-enabled malware to rapidly advance the threat landscape.

What You Should Do

• Change Default Passwords: Immediately replace all default and weak credentials on IoT devices with strong, unique passwords.
• Restrict Remote Access: Disable Telnet and limit SSH/remote administration access to only trusted IP addresses or internal networks.
• Apply Firmware Updates: Regularly check for and install the latest firmware updates from device manufacturers to patch known vulnerabilities.
• Network Segmentation: Isolate IoT devices on a separate network segment or VLAN from critical organizational systems to contain potential breaches.
• Monitor for Anomalies: Implement monitoring for unusual outbound network traffic and repeated failed authentication attempts, which can indicate a device is being recruited into a botnet.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.