# TuxBot v3 Evolution: Keksec-Linked IoT/Linux Botnet with Verbatim LLM Chain-of-Thought Code Artifacts

> TuxBot v3 Evolution is a multi-architecture IoT/Linux botnet framework (bot agent plus Go-based C2 with DDoS-for-hire capability) sharing dropper and C2 infrastructure with Kaitori v3.9 and AISURU, placing its operator inside the Keksec ecosystem. Source files contain raw, unremoved LLM chain-of-thought reasoning and a safety disclaimer the AI appended when asked to generate botnet code, and roughly 70% of its exploit/attack functionality is broken due to implementation bugs (magic-number mismatches, wrong XOR keys, hallucinated crypto).

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1397
- **ID:** TL-2026-1397
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Keksec-affiliated developer
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2013-7471, CVE-2014-8361, CVE-2017-17215, CVE-2018-10561, CVE-2022-30525, CVE-2023-39780, CVE-2020-8515, CVE-2022-1388, CVE-2022-22965, CVE-2022-44877

## Description

Palo Alto Networks Unit 42 (Chris Navarrete, Asher Davila, Doel Santos) disclosed TuxBot v3 Evolution, a previously unreported IoT botnet framework consisting of a C-based bot agent that cross-compiles for ARM, ARM64, MIPS, MIPSEL, MIPS64, x86_64, PowerPC, RISC-V, s390x and other architectures (17 total build targets), paired with a Go-based command-and-control server offering DDoS-for-hire functionality over a custom protocol, an interactive SSH admin shell (TCP 2222), and a JSON machine API (TCP 9999). The framework's lineage traces to Mirai, AISURU, and the undisclosed 'Wuhan' botnet family, with DDoS attack code partially ported from the open-source MHDDoS Python toolkit (78 nominal attack vectors mapped to only 6 functional handlers, including Slowloris, Apache Range, and WordPress XMLRPC pingback floods carried over as dead code).

The most novel finding is development tradecraft rather than technical sophistication: multiple C source files retain raw LLM chain-of-thought reasoning left verbatim in comments -- self-interruptions, internal decision narration, and direct references to 'the user' (the developer who prompted the model) -- indicating the bot's exploit VM, crypto layer, and DGA were substantially LLM-generated and shipped without review. Every .c file in the bot directory carries an unremoved AI safety disclaimer header ('for educational and authorized security research only'), and the LLM hallucinated a Argon2id key-derivation implementation that the developer shipped without verifying; at runtime it silently falls back to PBKDF2-SHA256 while still claiming Argon2id in its packet framing.

Operationally, the malware is roughly 70% functional. Its Telnet brute-forcer (1,496 credential pairs sourced from a 'DDOS-ROOTSEC pass_file' set, XOR-obfuscated with key 0xB4), ADB scanner, and SSH/HTTP scanners work as intended and represent the primary functional infection vector. Of 25 embedded IoT-exploit CVE targets, 13 are dead code never invoked, and 12 more are non-functional because the custom exploit-VM compiler emits magic value 0x54555845 ('TUXE') while the VM runtime expects 0x4558504C ('EXPL') -- a build/runtime mismatch that silently breaks every compiled exploit. IRC and HTTP C2 fallback channels are similarly broken due to a string-table XOR key mismatch (entries encrypted with 0x54, decrypted at runtime with 0xB4).

Working C2 channels use X25519 key exchange and ChaCha20-Poly1305 authenticated encryption with a 0xDEADBE01 handshake magic and 0xDEADBEEF packet magic; a SHA-512-based DGA (seed format '%04d-%02d-%02d-TuxBotv3-Evolution-Seed-2025-%d', 20 candidates/day across six TLDs) and a TCP 13337 P2P gossip protocol using Ed25519 signatures provide resilience if the primary C2 (209.182.237.133) is taken down. A dropper server at 185.10.68.127 (Iceland, FlokiNET bulletproof hosting) also serves Kaitori v3.9 binaries at the same path convention, directly linking TuxBot's operator to the Keksec/AISURU DDoS-for-hire ecosystem; passive DNS on that IP surfaces additional DDoS-for-hire domains active since 2021 (vrunabo.su, rezy1337.ted.ge, high.cpu.co.ua). Development artifacts trace a leaked internal hostname (newtuxdev.sevielw.digikalas.online) and a developer-registered domain (digikalas.online, Namecheap, Icelandic WHOIS privacy, hosted on Iranian Arvan Cloud) back to a January 2025 MHDDoS git clone, with production-quality (GCC 14.2.0) samples still being built and benchmarked as of April 2026.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1082 System Information Discovery
- T1210 Exploitation of Remote Services
- T1071 Application Layer Protocol
- T1568 Dynamic Resolution
- T1573 Encrypted Channel
- T1090 Proxy
- T1498 Network Denial of Service
- T1496 Resource Hijacking

## Sources

- [TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development](https://thehackernews.com/2026/07/tuxbot-v3-evolution-shows-signs-of-llm.html)
- [TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development](https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/)
- [TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development (forum mirror)](https://forum.ksec.co.uk/t/tuxbot-v3-inside-an-iot-botnet-framework-with-llm-assisted-development/16200)
- [TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development (forum mirror)](https://forum.ksec.co.uk/t/tuxbot-v3-evolution-shows-signs-of-llm-assisted-iot-botnet-development/16210)
- [TuxBot v3 Evolution (Akiru) Framework Analysis](https://community.gurucul.com/articles/ThreatResearch/TuxBot-v3-Evolution-Akiru-Framework-1-6-2026)
- [TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development](https://news.backbox.org/2026/07/15/tuxbot-v3-evolution-shows-signs-of-llm-assisted-iot-botnet-development/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1397