TLDR Tech / InfoSec
TuxBot v3 Evolution: Inside an IoT Botnet Framework With LLM-Assisted Development
Unit 42 traced the TuxBot v3 Evolution kill chain from Telnet brute-forcing across 1,496 credential pairs and largely non-functional native exploits, through seven persistence mechanisms including a disguised sd-pam.service and cron jobs, to an X25519/ChaCha20-encrypted primary C2 channel backed by a DGA and Ed25519-signed P2P fallbacks. The C2 server at 209.182.237[.]133 in Singapore and the dropper at 185.10.68[.]127 in Iceland share a Let's Encrypt certificate that ties them to an Iran-hosted developer and the wider Keksec/Kaitori/AISURU botnet ecosystem. Defenders should block the listed C2 and dropper IOCs, watch for Telnet brute-force attempts and the "Infected By Akiru" console banner, and treat this as a near-term threat since researchers showed the LLM-introduced bugs (XOR key mismatch, exploit VM magic mismatch, and hallucinated Argon2id) are trivially fixable.
Read the full story