Threat reportMalwareTL-2026-4829
Kairos Go-based DDoS Botnet Infects Linux Devices via Passwordless Root Telnet
Kairos Go-based DDoS Botnet Infects Linux Devices via (TL-2026-4829), also tracked as Kairos, is a high-severity malware campaign, first published 2026-10-30. It has no confirmed attribution, affects Various Linux-based devices (amd64, ARM, MIPS, MIPS-LE, i386) with, maps to 12 MITRE ATT&CK techniques (T1036.004, T1036.005, T1059.004), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 12MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-4829
- Threat ID
- TL-2026-4829
- Also known as
- Kairos, Kairos Hold'em
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, telecoms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Kairos Go-based DDoS Botnet Infects Linux Devices via
Malware and tooling: kairos
How Kairos Go-based DDoS Botnet Infects Linux Devices via works
Attackers log in over exposed Telnet as root with an empty password and deploy multi-architecture payloads for the Go-based Kairos DDoS botnet. The bot runs TCP connection-exhaustion floods on command and beacons to a single hardcoded C2 in plain text on TCP/9999. Analysis is credited to Nozomi Networks Labs.
Kairos (Nozomi Networks Labs title: 'Kairos Hold'em') is a previously undocumented Go-based DDoS botnet that spreads without any exploit or CVE. Operators connect to exposed Telnet services and log in as root with an empty password. They then run a multi-stage shell dropper: uname -m to pick the architecture, cd /tmp, removal of prior artifacts (rm -rf bot* .bot*), then payload download from an HTTP server on TCP/8080 (path /x86_64 in the published example) into .bot, .bot2, .bot3 and .bot4. The dropper tries wget, curl, BusyBox wget and TFTP in turn, applies chmod 777 and starts each payload in the background. Nozomi observed three distinct IP addresses delivering identical samples to its honeypots. Samples were built for amd64, ARM, MIPS (big- and little-endian) and 32-bit x86.
The bot registers with its C2 over a custom plain-text TCP protocol on port 9999. The beacon is 'REGISTER linux <arch> <NumCPU>', followed by a bare-newline keepalive every 2 seconds and unlimited reconnection attempts at 5-second intervals. The C2 address is a single hardcoded IPv4 literal with no fallback C2, and each C2 gets its own build of the same codebase. Observed Go toolchain versions are 1.27.0 and 1.27.1. The Go symbol table (.gopclntab) is intact and exposes developer package names such as kairos/bot, kairos/methods.HoldFlood and kairos/methods.holdConn. The supported commands are 'hold <host> <port> <seconds>', '!ka' (pause the bot and cancel running attacks) and '!ku' (resume accepting attacks).
The only attack method is a connection-exhaustion flood. The bot starts 128 workers per CPU core (minimum 256). Each worker completes a normal TCP three-way handshake with a 5-second timeout, then sends a single space character (0x20) every 5 seconds to keep the socket open. Failed connections are retried every 100 milliseconds. Source addresses are not spoofed, so the victim sees the real bot IPs. This exhausts the victim's connection table or worker pool rather than bandwidth.
The bot sets os.Args[0] to '[kworker/0:1]' to look like a kernel worker thread. It does not rewrite /proc/<pid>/cmdline or call prctl(PR_SET_NAME), so process inspection still reveals the real binary. The sources describe no persistence mechanism, no self-propagation and no general command execution in the bot. Re-infection depends on the exposed passwordless Telnet service. No attribution to a named actor, nation-state or motivation is made in the sources. Severity HIGH is the analyst's judgment, since no CVSS score applies.
Source discrepancy: Nozomi's post and the Cyber Security News article label the nine SHA-256 hashes with different architectures for several samples (for example, Cyber Security News groups 7635821e... and 82d0f225... under MIPS and 5743ebfc... under MIPS-LE). The IOC rows use Nozomi's labels and record the news article's label in extra_json. Treat the architecture labels as unverified and match on the hash. The fetch tool returned summaries of both pages, so verify against the originals before using the labels for attribution. BeaconBeagle lookups for 172.86.85.39, 91.92.42.84 and 85.11.167.41 returned HTTP 404, meaning no beacon records at the time of research.
MITRE ATT&CK techniques used in TL-2026-4829
Defense Evasion
T1036.004 Masquerading: Masquerade Task or Service; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell
Initial Access
T1078.001 Valid Accounts: Default Accounts; T1133 External Remote Services
Discovery
T1082 System Information Discovery
Command and Control
T1095 Non-Application Layer Protocol; T1571 Non-Standard Port
defense-impairment
T1222.002 Linux and Mac Permissions
Impact
T1498.001 Network Denial of Service: Direct Network Flood; T1499.002 Endpoint Denial of Service: Service Exhaustion Flood
Affected products and versions in Kairos Go-based DDoS Botnet Infects Linux Devices via
- Various — Linux-based devices (amd64, ARM, MIPS, MIPS-LE, i386) with exposed Telnet and a passwordless root account
Vulnerable versions: Any device exposing Telnet with root login and an empty password
Fixed in: Telnet disabled or a strong root password set
Remediation for Kairos Go-based DDoS Botnet Infects Linux Devices via
Immediate actions
- Block egress to 172.86.85.39, 91.92.42.84 and 85.11.167.41 and to TCP/9999 and TCP/8080 from IoT/Linux devices
- Block inbound connections from 103.124.165.53, 45.129.56.140 and 45.129.56.222 to Telnet
- Deploy an IDS signature for the plain-text 'REGISTER linux' beacon on TCP/9999
- Hunt for processes named '[kworker/0:1]' whose /proc/<pid>/exe points to a file under /tmp
- Hunt for hidden files .bot, .bot2, .bot3 and .bot4 in /tmp
- Scan files and memory with the YARA rule published by Nozomi Networks Labs
Workarounds
- Set a root password on every device and disable root login over Telnet
- Filter TCP/23 at the perimeter
- Mount /tmp noexec where the device supports it
Longer-term hardening
- Disable Telnet and use SSH with key-based or strong credentials
- Enforce strong, non-default credentials on all embedded and Linux devices, with no empty passwords
- Restrict management services from the internet and segment IoT devices
- Alert on plain-text registration protocol patterns and long-lived idle outbound TCP sessions
- Monitor for processes holding an excessive number of outbound TCP connections
Weaknesses (CWE) in Kairos Go-based DDoS Botnet Infects Linux Devices via
Timeline of Kairos Go-based DDoS Botnet Infects Linux Devices via
- Nozomi releases a YARA rule and recommends blocking egress on TCP/9999 and TCP/8080 and an IDS signature for the 'REGISTER linux' beacon
- Nozomi publishes six attacker/C2 IPs and nine SHA-256 hashes covering amd64, ARM, MIPS, MIPS-LE and i386 builds
- Nozomi documents the plain-text TCP/9999 protocol: REGISTER beacon, 2-second keepalive, 5-second reconnect, and the hold, !ka and !ku commands. Each C2 (172.86.85.39, 91.92.42.84, 85.11.167.41) has its own build
- Nozomi analyzes the samples, built for amd64, ARM, MIPS, MIPS-LE and 32-bit x86 with Go 1.27.0 and 1.27.1, and finds an intact .gopclntab exposing kairos/bot and kairos/methods.HoldFlood symbols
- Nozomi reports its honeypot saw three distinct IP addresses (103.124.165.53, 45.129.56.140, 45.129.56.222) delivering identical Kairos samples after root logins with an empty password; the exact observation dates are not stated in the sources
- Nozomi Networks Labs publishes 'Kairos Hold'em: Dissecting a New Go-Based DDoS Botnet', describing passwordless root Telnet infection and the Go-based Kairos bot
- Threadlinqs opens tracking for Kairos as TL-2026-4829 with status ACTIVE
- BeaconBeagle lookups for 172.86.85.39, 91.92.42.84 and 85.11.167.41 return HTTP 404, so there is no existing beacon record for the C2 infrastructure
- Cyber Security News (author Tushar Subhra Dutta) reports 'Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet'; its per-architecture hash grouping differs from Nozomi's
Sources cited for Kairos Go-based DDoS Botnet Infects Linux Devices via
- Kairos Hold'em: Dissecting a New Go-Based DDoS Botnet (Nozomi Networks Labs)
- Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet (Cyber Security News)
- MITRE ATT&CK T1078.001 Valid Accounts: Default Accounts
- MITRE ATT&CK T1499.002 Endpoint Denial of Service: Service Exhaustion Flood
- MITRE ATT&CK T1498.001 Network Denial of Service: Direct Network Flood
- MITRE ATT&CK T1105 Ingress Tool Transfer
- MITRE ATT&CK T1095 Non-Application Layer Protocol
Detection coverage for TL-2026-4829
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4829 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.