TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain
TuxBot v3 Evolution (TL-2026-1366), also tracked as TuxBot v3 Evolution, is a high-severity malware campaign scored CVSS 9.8, first published 2026-07-15 and last reviewed 2026-07-18. It is attributed to Iranian-hosted infrastructure (Iran) with medium confidence, affects F5 Networks BIG-IP, references 25 CVEs (CVE-2022-1388, CVE-2022-22965, CVE-2020-8515), maps to 44 MITRE ATT&CK techniques (T1005, T1008, T1014), and is covered by 9 detection rules and 39 indicators of compromise.
Key facts for TL-2026-1366
- Threat ID
- TL-2026-1366
- Also known as
- TuxBot v3 Evolution, TuxBot
- Severity
- HIGH
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-15
- Last reviewed
- 2026-07-18
- Attribution
- Iranian-hosted infrastructure
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Iran
- Motivation
- FINANCIAL
- Target sectors
- technology, telecoms, criticalinfrastructure, hostingcloud, gaming, anyinternetexposediot
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 39
- Updates
- 2026-07-18 · revalidated 1× · latest source
Malware and tooling in TuxBot v3 Evolution
Malware and tooling: Kaitori, TuxBot, MHDDoS
Unit 42 analyzed TuxBot v3 Evolution, a modular IoT botnet framework written in C/Go whose developers used an LLM to generate code, leaving raw chain-of-thought reasoning in source files and introducing functional bugs. The framework is roughly 70% operational: Telnet/SSH/HTTP/ADB scanning, credential brute-forcing, persistence, and DDoS work, but a bundled 25-CVE exploit chain, IRC/HTTP C2 fallback, and Layer-7 DDoS routing are all broken by LLM-introduced defects.
How TuxBot v3 Evolution works
TuxBot v3 Evolution is a modular IoT botnet framework built from a statically linked C bot agent (using glibc and libsodium) and a Go-based multi-user C2 control panel, cross-compiled for 17 architectures (x86_64, ARM, ARM64, MIPS, MIPSEL, MIPS64, PowerPC, RISC-V, PA-RISC, m68k, SPARC64, s390x, SH4, Alpha, and others). The bot propagates via a Telnet scanner brute-forcing 1,496 credential pairs sourced from DDOS-ROOTSEC pass files, plus SSH, HTTP (targeting /admin and /cpanel with hardcoded creds over up to 128 concurrent child-process connections), and Android Debug Bridge scanners. Persistence is achieved through seven redundant techniques: a systemd service disguised as sd-pam.service, cron @reboot and */5 entries, shell-profile injection (.bashrc/.profile/.zshrc), hidden backup copies at three filesystem locations, a crash-backoff guardian process, hardware watchdog keepalive, and polymorphic relocation across 21 directories masquerading under 20 different system daemon names. The DDoS engine registers 78 attack vectors across 6 handler functions (UDP/GRE/ICMP floods via sendmmsg() batching, TCP SYN floods, TCP ACK floods, TCP ACK+PSH stomp floods, DNS query floods, and a non-functional cryptomining placeholder) but has a critical routing bug: all 47 Layer-7 HTTP flood vectors (GET/POST floods, Slowloris, Apache Range attacks, WordPress XML-RPC pingback, Cloudflare-bypass variants) are dead-routed to the TCP SYN handler, so operators requesting HTTP floods silently receive SYN floods instead. Primary C2 runs encrypted TCP on ports 1999/31337 using a 0xDEADBE01 handshake magic with 32-byte X25519 key exchange, then 0xDEADBEEF-framed packets with a 12-byte nonce, ChaCha20 ciphertext, and a 16-byte Poly1305 MAC (libsodium X25519/ChaCha20-Poly1305/Ed25519). Four fallback channels exist: DNS TXT queries to c2.tuxbot.local (functional), a SHA-512-seeded DGA generating 20 domains/day from the seed pattern YYYY-MM-DD-TuxBotv3-Evolution-Seed-2025-[index] (functional), Ed25519-signed P2P gossip over TCP 13337 (functional), and both a plaintext IRC channel (port 6667) and an HTTP polling channel (127.0.0.1/cmd) that are broken by an XOR string-table key mismatch. The developers' LLM-assisted build process left extensive tradecraft failures: the C2 authentication module's header and comments claim Argon2id password hashing ('HashPassword creates a cryptographically secure password hash using Argon2id'), but the actual implementation is PBKDF2-style SHA-256 looping dressed up in an argon2id-formatted output string ($argon2id$v=19$m=%d,t=%d,p=%d$%s$%s), with a source comment admitting 'golang.org/x/crypto/argon2 isn't imported, we'll use our enhanced PBKDF2 with very high iterations.' Separately, the bot's XOR string table uses effective key 0xB4 for most entries but 9 entries (IRC server/port/channel, HTTP C2 URL, and four hardcoded exploit payloads for ThinkPHP, GPON, and Realtek UPnP) were encrypted with the stale key 0x54, corrupting them at runtime. All hardcoded exploit payloads reference dropper IP 185.10.68.127. The bundled exploit chain spans four categories, three of which are non-functional: (1) 13 CVEs plus 4 non-CVE targets implemented as native C functions inside exploit_engine_init(), which has zero callers anywhere in the codebase (dead code); (2) 13 CVEs plus 2 non-CVE targets implemented as 27 compiled .expl bytecode files for a custom exploit VM, broken because the Go compiler emits magic value 0x54555845 ('TUXE') while the C-side VM expects 0x4558504C ('EXPL'), and because the compiler's variable syntax never emits the VM's required OP_CONNECT opcode; (3) four HTTP/SOAP exploit payloads stored in the mis-keyed XOR string table, rendering them corrupted at decrypt time; (4) only the RCE vulnerability scanner and the ADB scanner are actually functional at runtime, and the RCE scanner's dropper IP is defunct. Unit 42 assessed that most of these broken components could be repaired with 'a handful of LLM-assisted prompts,' implying corrected production variants likely already exist in the wild. Development tradecraft evidence ties the project to a single developer: git commit logs record the hostname newtuxdev.sevielw.digikalas[.]online, an Iranian-hosted workstation resolving to 37.32.24.195 on Iran's Noyan Abr Arvan network; the digikalas[.]online domain was registered August 6, 2025 via Namecheap with WHOIS privacy (Withheld for Privacy ehf, Iceland). The dropper host at 185.10.68.127 (FlokiNET, Iceland) serves both TuxBot binaries and Kaitori v3.9 binaries, linking TuxBot to the Keksec/AISURU DDoS-for-hire ecosystem; passive DNS around that infrastructure surfaces vrunabo[.]su, rezy1337.ted[.]ge, and high.cpu.co[.]ua, all associated with DDoS-for-hire operity since 2021. A shared Let's Encrypt certificate for jetross[.]com appears on both the Singapore-hosted C2 (209.182.237.133) and the Iceland-hosted dropper, tying the two infrastructure roles to the same operator. The C2's SSH admin banner self-identifies as 'SSH-2.0-CNC-Control-Server' on port 2222, with a separate JSON machine API on port 9999. Development timeline: Jan 3, 2025 the developer clones MHDDoS from GitHub as a base; Jan 4-6, 2026 254 automated DDoS benchmark reports are generated during testing; Jan 20, 2026 the first debug-build sample (SHA256 71dfbb17...12fa8d) appears on VirusTotal; March 5, 2026 the C2 server is first observed by Xpanse at 209.182.237.133:2222; April 22, 2026 six new production samples built with GCC 14.2.0 are detected. Every source .c file carries an identical unmodified LLM safety disclaimer ('WARNING: This code is for educational and authorized security research only...'), and raw chain-of-thought reasoning is left in comments, e.g. 'If the user insists on "all exploits", I will add it but with a NOTE that checksums might fail,' 'Wait, where is the command?', and 'Actually, TFTP requires lock-step ACK; Let's assume if the system() call returns...' — direct evidence the malware's source was generated by an LLM with minimal human review before compilation and distribution. Infected hosts display the post-infection banner 'Infected By Akiru' and all HTTP requests use the User-Agent string 'TuxBot'.
MITRE ATT&CK techniques used in TL-2026-1366
Collection
T1005 Data from Local System; T1119 Automated Collection
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1572 Protocol Tunneling; T1573 Encrypted Channel
Defense Evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1497 Virtualization/Sandbox Evasion; T1497.001 Virtualization/Sandbox Evasion: System Checks
Lateral Movement
T1021 Remote Services; T1210 Exploitation of Remote Services
Persistence
T1037 Boot or Logon Initialization Scripts; T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
Discovery
T1046 Network Service Discovery; T1049 System Network Connections Discovery; T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution
Initial Access
T1078 Valid Accounts; T1078.001 Valid Accounts: Default Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Credential Access
Impact
T1496 Resource Hijacking; T1498 Network Denial of Service; T1499 Endpoint Denial of Service; T1499.003 Endpoint Denial of Service: Application Exhaustion Flood
Resource Development
T1583 Acquire Infrastructure; T1583.004 Acquire Infrastructure: Server; T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
T1592 Gather Victim Host Information; T1595.002 Active Scanning: Vulnerability Scanning
defense-impairment
Affected products and versions in TuxBot v3 Evolution
- F5 Networks — BIG-IP
Vulnerable versions: 16.1.x < 16.1.2.2; 15.1.x < 15.1.5.1; 14.1.x < 14.1.4.6; 13.1.x < 13.1.5; 12.1.x (all); 11.6.x (all)
Fixed in: 16.1.2.2; 15.1.5.1; 14.1.4.6; 13.1.5 - VMware / Spring — Spring Framework (Spring4Shell)
Vulnerable versions: 5.2.x < 5.2.20; 5.3.x < 5.3.18
Fixed in: 5.2.20; 5.3.18 - DrayTek — Vigor2960 / Vigor3900 / Vigor300B
Vulnerable versions: Vigor2960 1.3.1_Beta; Vigor3900 1.4.4_Beta; Vigor300B 1.3.3_Beta/1.4.2.1_Beta/1.4.4_Beta
Fixed in: 1.5.1 - CentOS Web Panel / Control Web Panel — CWP 7
Vulnerable versions: < 0.9.8.1147
Fixed in: 0.9.8.1147 - Generic IoT/embedded devices — Telnet/SSH/HTTP-managed embedded Linux devices
Vulnerable versions: devices using default/weak credentials from the 1,496-pair DDOS-ROOTSEC list
Fixed in: N/A - credential hygiene dependent
Remediation for TuxBot v3 Evolution
Patches
- F5 BIG-IP: upgrade to 16.1.2.2+, 15.1.5.1+, 14.1.4.6+, or 13.1.5+ (CVE-2022-1388)
- Spring Framework: upgrade to 5.3.18+ or 5.2.20+ (CVE-2022-22965)
- DrayTek Vigor2960/3900/300B: upgrade to firmware 1.5.1+ (CVE-2020-8515)
- CentOS Web Panel / Control Web Panel: upgrade to 0.9.8.1147+ (CVE-2022-44877)
Immediate actions
- Block C2 IPs 185.10.68.127 and 209.182.237.133 (ports 1999, 2222, 9999, 31337) at perimeter firewalls
- Block DNS resolution to c2.tuxbot.local and digikalas[.]online
- Change default/weak Telnet, SSH, and HTTP admin credentials on all internet-facing IoT and embedded devices
- Disable Telnet and restrict SSH/ADB exposure to the internet on IoT/embedded devices
- Patch F5 BIG-IP (CVE-2022-1388), Spring Framework (CVE-2022-22965), DrayTek Vigor (CVE-2020-8515), and CentOS/Control Web Panel (CVE-2022-44877) to vendor-fixed versions
Workarounds
- Restrict iControl REST management interface access on F5 BIG-IP to trusted networks
- Disable unused WAR-based Spring MVC/WebFlux deployment paths where patching is delayed
- Restrict cgi-bin/mainfunction.cgi access on DrayTek devices via ACL
- Restrict CWP login/index.php exposure to trusted management networks
Longer-term hardening
- Deploy network egress monitoring for the 0xDEADBE01/0xDEADBEEF C2 handshake and packet magic bytes
- Monitor DNS for high-entropy DGA-pattern domains matching the TuxBotv3-Evolution seed structure
- Deploy EDR/host monitoring for systemd units disguised as sd-pam.service and unexpected cron @reboot entries on embedded Linux hosts
- Implement asset inventory and firmware update programs for IoT/embedded device fleets to close the credential and CVE exposure window
- Monitor for the TuxBot HTTP User-Agent and 'Infected By Akiru' banner on network taps
CVEs associated with TuxBot v3 Evolution
CVE-2022-1388CVE-2022-22965CVE-2020-8515CVE-2022-44877CVE-2013-7471- CVE-2014-8361
CVE-2014-2321- CVE-2017-17215
CVE-2017-18377- CVE-2018-10561
- CVE-2018-10562
CVE-2018-20062CVE-2020-17456CVE-2022-30525CVE-2023-39780CVE-2025-34037CVE-2026-5815CVE-2007-3010CVE-2007-5693CVE-2016-11021CVE-2021-4045CVE-2021-25646CVE-2022-22947CVE-2023-1389CVE-2025-34117
Weaknesses (CWE) in TuxBot v3 Evolution
CWE-306, CWE-94, CWE-78, CWE-798, CWE-330, CWE-321, CWE-521, CWE-1240, CWE-693, CWE-671
Timeline of TuxBot v3 Evolution
- CVE-2022-1388 (F5 BIG-IP iControl REST unauthenticated RCE) is publicly disclosed by F5/NVD; nearly three years later it is one of the 25 CVEs bundled into TuxBot v3 Evolution's non-functional exploit_engine_init() and .expl bytecode modules.
- Developer clones MHDDoS from GitHub as the base for what becomes TuxBot v3 Evolution, per git commit history on the developer's workstation.
- Domain digikalas[.]online registered via Namecheap with WHOIS privacy (Withheld for Privacy ehf, Iceland); later tied to the developer's Iranian-hosted workstation hostname newtuxdev.sevielw.digikalas[.]online.
- 254 automated DDoS benchmark reports generated during developer testing over a three-day window (Jan 4-6, 2026).
- First TuxBot debug-build sample (SHA256 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d) uploaded to VirusTotal.
- TuxBot C2 server first observed by Palo Alto Xpanse at 209.182.237.133:2222 (SSH admin panel).
- Six new production-build TuxBot samples compiled with GCC 14.2.0 detected in the wild.
- Dropper IP 185.10.68.127 flagged as malicious on VirusTotal after continued observation serving TuxBot and Kaitori v3.9 payloads.
- Unit 42 (Palo Alto Networks) publishes technical analysis of TuxBot v3 Evolution, documenting LLM-assisted development, the broken exploit chain, and infrastructure attribution.
- Security Affairs, The Hacker News, Cybersecurity News, GBHackers, and other outlets publish follow-on coverage of the Unit 42 findings.
Update history for TL-2026-1366
- 2026-07-18 — TuxBot v3 Evolution — AI-Generated Modular IoT Botnet Linked to Keksec Ecosystem (Kaitori v3.9, AISURU): What changed Attribution firmed up: threat_actor Unknown (single developer) → Keksec (TuxBot/Kaitori/AISURU operator); nation_state Unknown → Iran, grounded in the same Arvan Cloud/digikalas.online infrastructure evidence already present in
Sources cited for TuxBot v3 Evolution
Threats related to TuxBot v3 Evolution
- TuxBot v3 Evolution: Keksec-Linked IoT/Linux Botnet with Verbatim LLM Chain-of-Thought Code Artifacts
- P2P Botnets in the Wild: Pink, Hajime, Mozi, FritzFrog, and Panchan — Decentralized C2 Landscape (360 Netlab Continuous Monitoring)
- RustDuck Botnet Rebuilt in Rust with Enhanced C2 Capabilities and Multi-Vector Exploitation
- Fodcha — Cross-Architecture DDoS Botnet Spreading via N-Day Exploits (CVE-2021-22205, CVE-2021-35394) and Telnet/SSH Brute-Force, Later Adding Ransom DDoS
- Self-Propagating SSH Worm with Cryptographically Signed C2
- Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process
Detection coverage for TL-2026-1366
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1366 across Splunk SPL, Microsoft KQL and Sigma, covering 39 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.