TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain — Threadlinqs Intelligence
As of 2026-07-18, TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain is a high-severity malware threat attributed to Keksec (TuxBot/Kaitori/AISURU operator) (Iran), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 39 indicators of compromise.
Threat ID: TL-2026-1366 · Severity: HIGH · CVSS: 9.8 · Status: ACTIVE · Category: MALWARE
Updated: 2026-07-18 · revalidated 1× · latest source
Attribution: Keksec (TuxBot/Kaitori/AISURU operator) · Iran · FINANCIAL
Unit 42 analyzed TuxBot v3 Evolution, a modular IoT botnet framework written in C/Go whose developers used an LLM to generate code, leaving raw chain-of-thought reasoning in source files and
TuxBot v3 Evolution is a modular IoT botnet framework built from a statically linked C bot agent (using glibc and libsodium) and a Go-based multi-user C2 control panel, cross-compiled for 17 architectures (x86_64, ARM, ARM64, MIPS, MIPSEL, MIPS64, PowerPC, RISC-V, PA-RISC, m68k, SPARC64, s390x, SH4, Alpha, and others). The bot propagates via a Telnet scanner brute-forcing 1,496 credential pairs sourced from DDOS-ROOTSEC pass files, plus SSH, HTTP (targeting /admin and /cpanel with hardcoded creds over up to 128 concurrent child-process connections), and Android Debug Bridge scanners. Persistence is achieved through seven redundant techniques: a systemd service disguised as sd-pam.service, cron @reboot and */5 entries, shell-profile injection (.bashrc/.profile/.zshrc), hidden backup copies at three filesystem locations, a crash-backoff guardian process, hardware watchdog keepalive, and polymorphic relocation across 21 directories masquerading under 20 different system daemon names. The DDoS engine registers 78 attack vectors across 6 handler functions (UDP/GRE/ICMP floods via sendmmsg() batching, TCP SYN floods, TCP ACK floods, TCP ACK+PSH stomp floods, DNS query floods, and a non-functional cryptomining placeholder) but has a critical routing bug: all 47 Layer-7 HTTP flood vectors (GET/POST floods, Slowloris, Apache Range attacks, WordPress XML-RPC pingback, Cloudflare-bypass variants) are dead-routed to the TCP SYN handler, so operators requesting HTTP floods silently receive SYN floods instead. Primary C2 runs encrypted TCP on ports 1999/31337 using a 0xDEADBE01 handshake magic with 32-byte X25519 key exchange, then 0xDEADBEEF-framed packets with a 12-byte nonce, ChaCha20 ciphertext, and a 16-byte Poly1305 MAC (libsodium X25519/ChaCha20-Poly1305/Ed25519). Four fallback channels exist: DNS TXT queries to c2.tuxbot.local (functional), a SHA-512-seeded DGA generating 20 domains/day from the seed pattern YYYY-MM-DD-TuxBotv3-Evolution-Seed-2025-[index] (functional), Ed25519-signed P2P gossip over TCP 13337 (functional), and both a plaintext IRC channel (port 6667) and an HTTP polling channel (127.0.0.1/cmd) that are broken by an XOR string-table key mismatch. The developers' LLM-assisted build process left extensive tradecraft failures: the C2 authentication module's header and comments claim Argon2id password hashing ('HashPassword creates a cryptographically secure password hash using Argon2id'), but the actual implementation is PBKDF2-style SHA-256 looping dressed up in an argon2id-formatted output string ($argon2id$v=19$m=%d,t=%d,p=%d$%s$%s), with a source comment admitting 'golang.org/x/crypto/argon2 isn't imported, we'll use our enhanced PBKDF2 with very high iterations.' Separately, the bot's XOR string table uses effective key 0xB4 for most entries but 9 entries (IRC server/port/channel, HTTP C2 URL, and four hardcoded exploit payloads for ThinkPHP, GPON, and Realtek UPnP) were encrypted with the stale key 0x54, corrupting them at runtime. All hardcoded exploit payloads reference dropper IP 185.10.68.127. The bundled exploit chain spans four categories, three of which are non-functional: (1) 13 CVEs plus 4 non-CVE targets implemented as native C functions inside exploit_engine_init(), which has zero callers anywhere in the codebase (dead code); (2) 13 CVEs plus 2 non-CVE targets implemented as 27 compiled .expl bytecode files for a custom exploit VM, broken because the Go compiler emits magic value 0x54555845 ('TUXE') while the C-side VM expects 0x4558504C ('EXPL'), and because the compiler's variable syntax never emits the VM's required OP_CONNECT opcode; (3) four HTTP/SOAP exploit payloads stored in the mis-keyed XOR string table, rendering them corrupted at decrypt time; (4) only the RCE vulnerability scanner and the ADB scanner are actually functional at runtime, and the RCE scanner's dropper IP is defunct. Unit 42 assessed that most of these broken components could be repaired with 'a handful of LLM-assisted prompts,
Weaknesses (CWE)
CWE-306, CWE-94, CWE-78, CWE-798, CWE-330, CWE-321, CWE-521, CWE-1240, CWE-693, CWE-671
Target sectors: technology, telecoms, criticalinfrastructure, hostingcloud, gaming, anyinternetexposediot
Target regions: Global
Detections & IOCs
As of 2026-07-21, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 39 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, CVE-2022-1388, CVE-2022-22965, CVE-2020-8515, CVE-2022-44877, CVE-2013-7471, CVE-2014-8361, CVE-2014-2321, CVE-2017-17215, CVE-2017-18377, CVE-2018-10561, T1592, T1587, T1583, T1588, T1190, T1133, T1078, T1059, T1203, T1543