TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework Uncovered by Unit 42

Cybersecurity researchers at Palo Alto Networks Unit 42 have disclosed a previously unreported IoT botnet framework named TuxBot v3 Evolution, which shows signs of being developed with assistance from a large language model (LLM). The botnet includes a C-based bot agent that cross-compiles for multiple architectures (ARM, MIPS, MIPSEL, MIPS64, x86_64, PowerPC, RISC-V), a Go-based command-and-control (C2) server with a DDoS-for-hire panel, a custom exploit virtual machine, Docker-based test infrastructure, and an automated build system.

The bot agent brute-forces Telnet access using 1,496 credential pairs and incorporates exploit code targeting over 30 IoT device families. It communicates with the C2 server over an encrypted TCP channel, with fallback mechanisms including a SHA512 domain generation algorithm (DGA), peer-to-peer gossip protocol with Ed25519-signed commands, IRC, DNS TXT queries, and HTTP polling. The framework’s lineage traces back to Mirai, AISURU, and Wuhan botnets, and partially ports functions from the open-source MHDDoS Python DDoS toolkit.

Unit 42 noted that the LLM included a safety disclaimer that the developer failed to remove, and several functions in analyzed samples failed to work correctly, suggesting manual code review would have resolved these errors. The botnet follows a pre-defined initialization sequence including anti-debugging and anti-VM protections, process name hiding, persistence via systemd, cron, and watchdog, and launching sub-modules for DDoS attacks, competing process termination, C2 channels over IRC/HTTP/DNS/P2P, scanners for Telnet/SSH/HTTP/ADB, a SOCKS5 proxy, and a cryptocurrency mining placeholder. Shared infrastructure with Kaitori v3.9 and AISURU tooling places the TuxBot operator within the Keksec ecosystem.