# Kairos Go-based DDoS Botnet Infects Linux Devices via Passwordless Root Telnet

> Attackers log in over exposed Telnet as root with an empty password and deploy multi-architecture payloads for the Go-based Kairos DDoS botnet. The bot runs TCP connection-exhaustion floods on command and beacons to a single hardcoded C2 in plain text on TCP/9999. Analysis is credited to Nozomi Networks Labs.

- **Published:** 2026-10-30T13:38:39Z
- **Last reviewed:** 2026-10-30T13:38:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4829
- **ID:** TL-2026-4829
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Kairos (Nozomi Networks Labs title: 'Kairos Hold'em') is a previously undocumented Go-based DDoS botnet that spreads without any exploit or CVE. Operators connect to exposed Telnet services and log in as root with an empty password. They then run a multi-stage shell dropper: uname -m to pick the architecture, cd /tmp, removal of prior artifacts (rm -rf bot* .bot*), then payload download from an HTTP server on TCP/8080 (path /x86_64 in the published example) into .bot, .bot2, .bot3 and .bot4. The dropper tries wget, curl, BusyBox wget and TFTP in turn, applies chmod 777 and starts each payload in the background. Nozomi observed three distinct IP addresses delivering identical samples to its honeypots. Samples were built for amd64, ARM, MIPS (big- and little-endian) and 32-bit x86.

The bot registers with its C2 over a custom plain-text TCP protocol on port 9999. The beacon is 'REGISTER linux <arch> <NumCPU>', followed by a bare-newline keepalive every 2 seconds and unlimited reconnection attempts at 5-second intervals. The C2 address is a single hardcoded IPv4 literal with no fallback C2, and each C2 gets its own build of the same codebase. Observed Go toolchain versions are 1.27.0 and 1.27.1. The Go symbol table (.gopclntab) is intact and exposes developer package names such as kairos/bot, kairos/methods.HoldFlood and kairos/methods.holdConn. The supported commands are 'hold <host> <port> <seconds>', '!ka' (pause the bot and cancel running attacks) and '!ku' (resume accepting attacks).

The only attack method is a connection-exhaustion flood. The bot starts 128 workers per CPU core (minimum 256). Each worker completes a normal TCP three-way handshake with a 5-second timeout, then sends a single space character (0x20) every 5 seconds to keep the socket open. Failed connections are retried every 100 milliseconds. Source addresses are not spoofed, so the victim sees the real bot IPs. This exhausts the victim's connection table or worker pool rather than bandwidth.

The bot sets os.Args[0] to '[kworker/0:1]' to look like a kernel worker thread. It does not rewrite /proc/<pid>/cmdline or call prctl(PR_SET_NAME), so process inspection still reveals the real binary. The sources describe no persistence mechanism, no self-propagation and no general command execution in the bot. Re-infection depends on the exposed passwordless Telnet service. No attribution to a named actor, nation-state or motivation is made in the sources. Severity HIGH is the analyst's judgment, since no CVSS score applies.

Source discrepancy: Nozomi's post and the Cyber Security News article label the nine SHA-256 hashes with different architectures for several samples (for example, Cyber Security News groups 7635821e... and 82d0f225... under MIPS and 5743ebfc... under MIPS-LE). The IOC rows use Nozomi's labels and record the news article's label in extra_json. Treat the architecture labels as unverified and match on the hash. The fetch tool returned summaries of both pages, so verify against the originals before using the labels for attribution. BeaconBeagle lookups for 172.86.85.39, 91.92.42.84 and 85.11.167.41 returned HTTP 404, meaning no beacon records at the time of research.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078.001 Valid Accounts: Default Accounts
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1082 System Information Discovery
- T1036.004 Masquerading: Masquerade Task or Service
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1070.004 Indicator Removal: File Deletion
- T1222.002 Linux and Mac Permissions
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1498.001 Network Denial of Service: Direct Network Flood
- T1499.002 Endpoint Denial of Service: Service Exhaustion Flood

## Sources

- [Kairos Hold'em: Dissecting a New Go-Based DDoS Botnet (Nozomi Networks Labs)](https://www.nozominetworks.com/blog/kairos-holdem-dissecting-a-new-go-based-ddos-botnet)
- [Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet (Cyber Security News)](https://cybersecuritynews.com/hackers-exploit-passwordless-telnet/)
- [MITRE ATT&CK T1078.001 Valid Accounts: Default Accounts](https://attack.mitre.org/techniques/T1078/001/)
- [MITRE ATT&CK T1499.002 Endpoint Denial of Service: Service Exhaustion Flood](https://attack.mitre.org/techniques/T1499/002/)
- [MITRE ATT&CK T1498.001 Network Denial of Service: Direct Network Flood](https://attack.mitre.org/techniques/T1498/001/)
- [MITRE ATT&CK T1105 Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105/)
- [MITRE ATT&CK T1095 Non-Application Layer Protocol](https://attack.mitre.org/techniques/T1095/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4829