# Keksec-affiliated developer

> As of 2026-07-16, Keksec-affiliated developer is a threat actor tracked by Threadlinqs Intelligence across 1 threat spanning malware.

- **Tracked threats:** 1
- **Categories:** MALWARE
- **As of:** 2026-07-16

## Tracked threats

- [TuxBot v3 Evolution: Keksec-Linked IoT/Linux Botnet with Verbatim LLM Chain-of-Thought Code Artifacts](https://intel.threadlinqs.com/threat/TL-2026-1397) — MEDIUM

## Related CVEs

10 CVEs referenced by tracked Keksec-affiliated developer activity.

- [CVE-2023-39780](https://intel.threadlinqs.com/cve/CVE-2023-39780)
- [CVE-2022-44877](https://intel.threadlinqs.com/cve/CVE-2022-44877)
- [CVE-2022-30525](https://intel.threadlinqs.com/cve/CVE-2022-30525)
- [CVE-2022-22965](https://intel.threadlinqs.com/cve/CVE-2022-22965)
- [CVE-2022-1388](https://intel.threadlinqs.com/cve/CVE-2022-1388)
- [CVE-2020-8515](https://intel.threadlinqs.com/cve/CVE-2020-8515)
- [CVE-2018-10561](https://intel.threadlinqs.com/cve/CVE-2018-10561)
- [CVE-2017-17215](https://intel.threadlinqs.com/cve/CVE-2017-17215)
- [CVE-2014-8361](https://intel.threadlinqs.com/cve/CVE-2014-8361)
- [CVE-2013-7471](https://intel.threadlinqs.com/cve/CVE-2013-7471)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Keksec-affiliated%20developer