# TuxBot v3 Evolution: LLM-Assisted IoT Botnet Framework With a Broken Multi-CVE Exploit Chain

> Unit 42 analyzed TuxBot v3 Evolution, a modular IoT botnet framework written in C/Go whose developers used an LLM to generate code, leaving raw chain-of-thought reasoning in source files and introducing functional bugs. The framework is roughly 70% operational: Telnet/SSH/HTTP/ADB scanning, credential brute-forcing, persistence, and DDoS work, but a bundled 25-CVE exploit chain, IRC/HTTP C2 fallback, and Layer-7 DDoS routing are all broken by LLM-introduced defects.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-18T23:25:44.827Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1366
- **ID:** TL-2026-1366
- **Severity:** HIGH (CVSS 9.8)
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Keksec (Iran)
- **Detections:** 9 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2022-1388, CVE-2022-22965, CVE-2020-8515, CVE-2022-44877, CVE-2013-7471, CVE-2014-8361, CVE-2014-2321, CVE-2017-17215, CVE-2017-18377, CVE-2018-10561, CVE-2018-10562, CVE-2018-20062, CVE-2020-17456, CVE-2022-30525, CVE-2023-39780, CVE-2025-34037, CVE-2026-5815, CVE-2007-3010, CVE-2007-5693, CVE-2016-11021, CVE-2021-4045, CVE-2021-25646, CVE-2022-22947, CVE-2023-1389, CVE-2025-34117

## Description

TuxBot v3 Evolution is a modular IoT botnet framework built from a statically linked C bot agent (using glibc and libsodium) and a Go-based multi-user C2 control panel, cross-compiled for 17 architectures (x86_64, ARM, ARM64, MIPS, MIPSEL, MIPS64, PowerPC, RISC-V, PA-RISC, m68k, SPARC64, s390x, SH4, Alpha, and others). The bot propagates via a Telnet scanner brute-forcing 1,496 credential pairs sourced from DDOS-ROOTSEC pass files, plus SSH, HTTP (targeting /admin and /cpanel with hardcoded creds over up to 128 concurrent child-process connections), and Android Debug Bridge scanners. Persistence is achieved through seven redundant techniques: a systemd service disguised as sd-pam.service, cron @reboot and */5 entries, shell-profile injection (.bashrc/.profile/.zshrc), hidden backup copies at three filesystem locations, a crash-backoff guardian process, hardware watchdog keepalive, and polymorphic relocation across 21 directories masquerading under 20 different system daemon names. The DDoS engine registers 78 attack vectors across 6 handler functions (UDP/GRE/ICMP floods via sendmmsg() batching, TCP SYN floods, TCP ACK floods, TCP ACK+PSH stomp floods, DNS query floods, and a non-functional cryptomining placeholder) but has a critical routing bug: all 47 Layer-7 HTTP flood vectors (GET/POST floods, Slowloris, Apache Range attacks, WordPress XML-RPC pingback, Cloudflare-bypass variants) are dead-routed to the TCP SYN handler, so operators requesting HTTP floods silently receive SYN floods instead. Primary C2 runs encrypted TCP on ports 1999/31337 using a 0xDEADBE01 handshake magic with 32-byte X25519 key exchange, then 0xDEADBEEF-framed packets with a 12-byte nonce, ChaCha20 ciphertext, and a 16-byte Poly1305 MAC (libsodium X25519/ChaCha20-Poly1305/Ed25519). Four fallback channels exist: DNS TXT queries to c2.tuxbot.local (functional), a SHA-512-seeded DGA generating 20 domains/day from the seed pattern YYYY-MM-DD-TuxBotv3-Evolution-Seed-2025-[index] (functional), Ed25519-signed P2P gossip over TCP 13337 (functional), and both a plaintext IRC channel (port 6667) and an HTTP polling channel (127.0.0.1/cmd) that are broken by an XOR string-table key mismatch. The developers' LLM-assisted build process left extensive tradecraft failures: the C2 authentication module's header and comments claim Argon2id password hashing ('HashPassword creates a cryptographically secure password hash using Argon2id'), but the actual implementation is PBKDF2-style SHA-256 looping dressed up in an argon2id-formatted output string ($argon2id$v=19$m=%d,t=%d,p=%d$%s$%s), with a source comment admitting 'golang.org/x/crypto/argon2 isn't imported, we'll use our enhanced PBKDF2 with very high iterations.' Separately, the bot's XOR string table uses effective key 0xB4 for most entries but 9 entries (IRC server/port/channel, HTTP C2 URL, and four hardcoded exploit payloads for ThinkPHP, GPON, and Realtek UPnP) were encrypted with the stale key 0x54, corrupting them at runtime. All hardcoded exploit payloads reference dropper IP 185.10.68.127. The bundled exploit chain spans four categories, three of which are non-functional: (1) 13 CVEs plus 4 non-CVE targets implemented as native C functions inside exploit_engine_init(), which has zero callers anywhere in the codebase (dead code); (2) 13 CVEs plus 2 non-CVE targets implemented as 27 compiled .expl bytecode files for a custom exploit VM, broken because the Go compiler emits magic value 0x54555845 ('TUXE') while the C-side VM expects 0x4558504C ('EXPL'), and because the compiler's variable syntax never emits the VM's required OP_CONNECT opcode; (3) four HTTP/SOAP exploit payloads stored in the mis-keyed XOR string table, rendering them corrupted at decrypt time; (4) only the RCE vulnerability scanner and the ADB scanner are actually functional at runtime, and the RCE scanner's dropper IP is defunct. Unit 42 assessed that most of these broken components could be repaired with 'a handful of LLM-assisted prompts,' implying corrected production variants likely already exist in the wild. Development tradecraft evidence ties the project to a single developer: git commit logs record the hostname newtuxdev.sevielw.digikalas[.]online, an Iranian-hosted workstation resolving to 37.32.24.195 on Iran's Noyan Abr Arvan network; the digikalas[.]online domain was registered August 6, 2025 via Namecheap with WHOIS privacy (Withheld for Privacy ehf, Iceland). The dropper host at 185.10.68.127 (FlokiNET, Iceland) serves both TuxBot binaries and Kaitori v3.9 binaries, linking TuxBot to the Keksec/AISURU DDoS-for-hire ecosystem; passive DNS around that infrastructure surfaces vrunabo[.]su, rezy1337.ted[.]ge, and high.cpu.co[.]ua, all associated with DDoS-for-hire operity since 2021. A shared Let's Encrypt certificate for jetross[.]com appears on both the Singapore-hosted C2 (209.182.237.133) and the Iceland-hosted dropper, tying the two infrastructure roles to the same operator. The C2's SSH admin banner self-identifies as 'SSH-2.0-CNC-Control-Server' on port 2222, with a separate JSON machine API on port 9999. Development timeline: Jan 3, 2025 the developer clones MHDDoS from GitHub as a base; Jan 4-6, 2026 254 automated DDoS benchmark reports are generated during testing; Jan 20, 2026 the first debug-build sample (SHA256 71dfbb17...12fa8d) appears on VirusTotal; March 5, 2026 the C2 server is first observed by Xpanse at 209.182.237.133:2222; April 22, 2026 six new production samples built with GCC 14.2.0 are detected. Every source .c file carries an identical unmodified LLM safety disclaimer ('WARNING: This code is for educational and authorized security research only...'), and raw chain-of-thought reasoning is left in comments, e.g. 'If the user insists on "all exploits", I will add it but with a NOTE that checksums might fail,' 'Wait, where is the command?', and 'Actually, TFTP requires lock-step ACK; Let's assume if the system() call returns...' — direct evidence the malware's source was generated by an LLM with minimal human review before compilation and distribution. Infected hosts display the post-infection banner 'Infected By Akiru' and all HTTP requests use the User-Agent string 'TuxBot'.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1543 Create or Modify System Process
- T1053 Scheduled Task/Job
- T1037 Boot or Logon Initialization Scripts
- T1014 Rootkit
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1110 Brute Force
- T1046 Network Service Discovery
- T1057 Process Discovery
- T1049 System Network Connections Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1008 Fallback Channels
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1090 Proxy
- T1571 Non-Standard Port
- T1498 Network Denial of Service
- T1499 Endpoint Denial of Service
- T1496 Resource Hijacking
- T1595.002 Active Scanning: Vulnerability Scanning
- T1583.004 Acquire Infrastructure: Server
- T1078.001 Valid Accounts: Default Accounts
- T1546.004 Event Triggered Execution: Unix Shell Configuration Modification
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 Indicator Removal: File Deletion
- T1685 Disable or Modify Tools
- T1082 System Information Discovery

## Sources

- [TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development](https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/)
- [NVD - CVE-2022-1388](https://nvd.nist.gov/vuln/detail/CVE-2022-1388)
- [NVD - CVE-2022-22965 (Spring4Shell)](https://nvd.nist.gov/vuln/detail/CVE-2022-22965)
- [NVD - CVE-2020-8515 (DrayTek Vigor RCE)](https://nvd.nist.gov/vuln/detail/CVE-2020-8515)
- [NVD - CVE-2022-44877 (CentOS Web Panel RCE)](https://nvd.nist.gov/vuln/detail/CVE-2022-44877)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1366