Introduction to TuxBot v3 Evolution
Runtime Rebel analysts have identified a previously undocumented, modular internet-of-things (IoT) botnet framework named TuxBot v3 Evolution. This framework exhibits a unique development history, notably leveraging large language models (LLMs) to assist in its code generation. While the LLM assistance yielded mixed results, including non-functional components and unremoved safety disclaimers, the core infection and attack capabilities remain viable, indicating a significant potential threat, especially if patched versions emerge, which is highly likely according to Unit 42.
The discovery of TuxBot v3 Evolution stems from an archive containing its complete source code, compiled binaries for 17 architectures, and automated distributed denial of service (DDoS) performance testing reports. This comprehensive data allowed for an in-depth analysis of the botnet’s structure, functionality, and development lifecycle.
Technical Analysis of TuxBot v3
The TuxBot v3 Evolution IoT botnet framework is designed for broad IoT device compromise and subsequent DDoS operations. Its modular architecture suggests derivation from existing botnet codebases, specifically integrating features from AISURU and the previously unknown Wuhan botnet lineages. Furthermore, elements have been partially ported from the open-source MHDDoS Python DDoS toolkit, highlighting a trend of combining and adapting existing malicious tools.
LLM-Assisted Development and Functionality
The most distinctive aspect of TuxBot v3 is its LLM-assisted botnet development analysis. The malware authors explicitly used an LLM to generate C modules, port exploits, and write C2 server code. This reliance on AI, however, introduced several bugs, rendering approximately 30 exploit systems non-functional in the analyzed samples. Interestingly, the LLM even included a safety disclaimer in the generated code that the developers failed to remove. Despite these initial flaws, the core infection flow—which includes scanning, credential brute-forcing, persistence mechanisms, primary C2 setup, and DDoS execution—is confirmed to be operational. This suggests that with minimal effort, an adversary could rectify the documented bugs, leading to a more potent version.
Infection Vectors and Botnet Lineage
Threat actors deploy the TuxBot agent to brute-force Telnet access on targeted IoT devices. The botnet leverages a substantial list of 1,496 credential pairs, making its Telnet scanner a highly effective infection vector. Once compromised, devices display the console banner “Infected By Akiru” and communicate with a C2 server over an encrypted TCP channel, typically on ports 1999 or 31337. The framework supports dual versioning, with an installer version 3.5.2 and an internal Docker configuration version 3.0.0-EVOLUTION-FINAL.
Attribution and Infrastructure
The development timeline, reconstructed from a Git log within the source code, suggests active development leading up to January 2026. The developer’s workstation hostname, captured in the Git log, indicates an Iranian-hosted origin. Infrastructure analysis further linked TuxBot to the Keksec/Kaitori ecosystems, known for their Tsunami/Mirai/Gafgyt variants, through a shared IP address (185.10.68[.]127). This connection implies either direct collaboration or shared infrastructure usage among these distinct, yet often overlapping, botnet operations.
Mitigating Telnet Brute-Force Attacks on IoT Devices
Given TuxBot v3’s reliance on Telnet brute-forcing, defenders should prioritize specific mitigations to protect IoT environments. Addressing vulnerabilities related to Telnet is crucial for preventing initial compromise. For security professionals researching mitigating Telnet brute-force attacks on IoT devices, the following steps are highly recommended:
- Disable Telnet: Whenever possible, disable Telnet services on all IoT devices. Telnet transmits data, including credentials, in cleartext, making it inherently insecure. Prefer secure alternatives like SSH with strong authentication.
- Strong, Unique Passwords: Ensure all IoT devices are configured with strong, unique, and complex passwords. Avoid default credentials at all costs, as these are primary targets for botnets like TuxBot v3.
- Network Segmentation: Isolate IoT devices on a dedicated network segment (VLAN) to limit their ability to communicate with sensitive internal systems and restrict outbound internet access to only necessary services.
- Firmware Updates: Regularly apply firmware updates and patches provided by manufacturers. These updates often address known vulnerabilities that could be exploited by botnets.
- Intrusion Detection/Prevention Systems (IDPS): Implement IDPS solutions to monitor network traffic for suspicious activity, including brute-force attempts on Telnet or unusual outbound connections from IoT devices.
- Access Control: Restrict network access to IoT devices from the internet. If remote access is necessary, use VPNs or secure gateways.
Related: Dysphoria Botnet Adopts Blockchain C2 for Enhanced IoT Resilience, LLM Text-in-Text Steganography: Emerging Covert Channel Risks