# Keksec

> As of 2026-07-18, Keksec is a Iran-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning malware. Also known as Iranian-hosted infrastructure, AISURU ecosystem-linked.

- **Nation:** Iran
- **Tracked threats:** 1
- **Categories:** MALWARE
- **Also known as:** Iranian-hosted infrastructure, AISURU ecosystem-linked
- **As of:** 2026-07-18

## Tracked threats

- [TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain](https://intel.threadlinqs.com/threat/TL-2026-1366) — HIGH

## Related CVEs

25 CVEs referenced by tracked Keksec activity.

- [CVE-2026-5815](https://intel.threadlinqs.com/cve/CVE-2026-5815)
- [CVE-2025-34117](https://intel.threadlinqs.com/cve/CVE-2025-34117)
- [CVE-2025-34037](https://intel.threadlinqs.com/cve/CVE-2025-34037)
- [CVE-2023-39780](https://intel.threadlinqs.com/cve/CVE-2023-39780)
- [CVE-2023-1389](https://intel.threadlinqs.com/cve/CVE-2023-1389)
- [CVE-2022-44877](https://intel.threadlinqs.com/cve/CVE-2022-44877)
- [CVE-2022-30525](https://intel.threadlinqs.com/cve/CVE-2022-30525)
- [CVE-2022-22965](https://intel.threadlinqs.com/cve/CVE-2022-22965)
- [CVE-2022-22947](https://intel.threadlinqs.com/cve/CVE-2022-22947)
- [CVE-2022-1388](https://intel.threadlinqs.com/cve/CVE-2022-1388)
- [CVE-2021-4045](https://intel.threadlinqs.com/cve/CVE-2021-4045)
- [CVE-2021-25646](https://intel.threadlinqs.com/cve/CVE-2021-25646)
- [CVE-2020-8515](https://intel.threadlinqs.com/cve/CVE-2020-8515)
- [CVE-2020-17456](https://intel.threadlinqs.com/cve/CVE-2020-17456)
- [CVE-2018-20062](https://intel.threadlinqs.com/cve/CVE-2018-20062)
- [CVE-2018-10562](https://intel.threadlinqs.com/cve/CVE-2018-10562)
- [CVE-2018-10561](https://intel.threadlinqs.com/cve/CVE-2018-10561)
- [CVE-2017-18377](https://intel.threadlinqs.com/cve/CVE-2017-18377)
- [CVE-2017-17215](https://intel.threadlinqs.com/cve/CVE-2017-17215)
- [CVE-2016-11021](https://intel.threadlinqs.com/cve/CVE-2016-11021)
- [CVE-2014-8361](https://intel.threadlinqs.com/cve/CVE-2014-8361)
- [CVE-2014-2321](https://intel.threadlinqs.com/cve/CVE-2014-2321)
- [CVE-2013-7471](https://intel.threadlinqs.com/cve/CVE-2013-7471)
- [CVE-2007-5693](https://intel.threadlinqs.com/cve/CVE-2007-5693)
- [CVE-2007-3010](https://intel.threadlinqs.com/cve/CVE-2007-3010)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Keksec