{
  "name": "Inside an IoT Botnet Framework With LLM-Assisted Development",
  "slug": "inside-an-iot-botnet-framework-with-llm-assisted-development",
  "description": "A previously undocumented modular IoT botnet framework has been identified with code partially generated using large language models. The framework consists of C-based bot agents compiled for 17 architectures, a Go-based command-and-control server with DDoS-for-hire panel, and custom exploit capabilities. Bot agents brute-force Telnet access using 1,496 credential pairs and target over 30 IoT device families. While core infection mechanisms function properly, several features are broken due to LLM-generated bugs that were shipped without manual review. The framework includes multiple fallback C2 mechanisms including domain generation algorithms, peer-to-peer gossip, IRC, and DNS TXT queries. Infrastructure analysis links this operation to the Keksec ecosystem through shared dropper servers. Development timeline spans from January 2025 to April 2026, with active C2 infrastructure observed since March 2026.",
  "published": "2026-07-15T11:58:11.946000+00:00",
  "created_at": "2026-07-15T14:37:57.779000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-07-15T14:37:57.779000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "aisuru",
    "ddos-for-hire",
    "gafgyt",
    "iot botnet",
    "kaitori",
    "keksec ecosystem",
    "llm-generated code",
    "mhddos",
    "telnet brute-force",
    "tsunami",
    "tuxbot v3"
  ],
  "tags": [],
  "related_entities": {
    "vulnerabilities": [
      {
        "id": "7a6d9b7f-523a-4990-8636-ff2565e99d0e",
        "name": "CVE-2017-17215"
      },
      {
        "id": "e803eeb1-0342-4ce9-9ea0-b1166d5d7ce7",
        "name": "CVE-2014-2321"
      },
      {
        "id": "ddeadf2d-9ae5-4f97-8e29-bbf73bc8cb6e",
        "name": "CVE-2023-39780"
      },
      {
        "id": "44589e8c-9655-4ce5-98db-1a848b425646",
        "name": "CVE-2026-5815"
      },
      {
        "id": "818446e2-b226-4172-993c-34d99320b965",
        "name": "CVE-2018-20062"
      },
      {
        "id": "7c226708-86f1-4761-8519-31d5cffa976d",
        "name": "CVE-2022-1388"
      },
      {
        "id": "2a05ec8a-d7be-42c5-b8e3-d4273d8d5d4f",
        "name": "CVE-2021-25646"
      },
      {
        "id": "63205d0e-c12a-4d82-bbea-85db956d09c3",
        "name": "CVE-2018-10561"
      },
      {
        "id": "fa969ab5-5a13-4a81-bfd8-ea66b3655ce8",
        "name": "CVE-2022-22965"
      },
      {
        "id": "bd781c8f-8e76-4271-8977-0f76e4bdde1d",
        "name": "CVE-2022-30525"
      },
      {
        "id": "f8161c0f-54bc-4b51-9a56-6a6470df409f",
        "name": "CVE-2013-7471"
      },
      {
        "id": "2fa05176-c856-4b91-9b59-85fa2c51ff56",
        "name": "CVE-2022-44877"
      },
      {
        "id": "792c625c-f209-4f2f-807d-58f78d81ed7c",
        "name": "CVE-2020-17456"
      },
      {
        "id": "c5995621-dc08-4359-9771-7a97152369ea",
        "name": "CVE-2017-18377"
      },
      {
        "id": "90d918fc-0b8e-4a4b-af74-b370f27582ab",
        "name": "CVE-2007-3010"
      },
      {
        "id": "a46fa6fc-5461-4d31-88c0-4158cdf2eb8e",
        "name": "CVE-2025-34037"
      },
      {
        "id": "eadda105-f6fd-4d11-ad7f-440c312693cf",
        "name": "CVE-2016-11021"
      },
      {
        "id": "1a800728-a09a-4bc9-8f68-19d90318ce9e",
        "name": "CVE-2007-5693"
      },
      {
        "id": "82ca34e5-ad2f-4062-9014-2cfe54e3a8b9",
        "name": "CVE-2014-8361"
      },
      {
        "id": "b44e6921-2445-41fb-bc64-5aeabfc9f659",
        "name": "CVE-2020-8515"
      },
      {
        "id": "19ece6ba-c2eb-4a63-8288-95b09ed3ace5",
        "name": "CVE-2023-1389"
      },
      {
        "id": "11bd74b1-ebc1-4bc7-b916-5eb92892dbd7",
        "name": "CVE-2022-22947"
      },
      {
        "id": "561599fa-5947-496f-9a9f-05920b366213",
        "name": "CVE-2018-10562"
      },
      {
        "id": "37e3d14c-8c01-4a0b-a77d-054f2f9b9807",
        "name": "CVE-2025-34117"
      },
      {
        "id": "c564b8c8-fde8-413c-9e9c-3f6939e55520",
        "name": "CVE-2021-4045"
      }
    ],
    "indicators": [
      {
        "id": "a20a0052-8a16-464a-90d1-7318c04287e4",
        "name": "c7a36d6b8128c41f93a32413675401a10a2b5769b221bbaa8c5c309585b73ceb"
      },
      {
        "id": "7af4a4f2-b582-4387-be3d-c5841a1c636a",
        "name": "3ec016d637e4c9cd331edd2580a229621ad638e924a4aa29ac0342e9144ace19"
      },
      {
        "id": "4375efd7-2c6c-4ca7-b21e-9c167686a83b",
        "name": "2f2c3551762c03da126e45dca6fc2f997c63f0f1bfc21fd0ceed680ac6f083ce"
      },
      {
        "id": "ddf114e3-2423-42ce-9588-2fcf0debf8c1",
        "name": "eb2fa179fde2f097c18d5d700ad87d660fc238ee14cbe5477032e60856859621"
      },
      {
        "id": "18b74f94-e6ef-4b1a-a012-b103f9568904",
        "name": "246c97957651de568e61eba1abe572f0b0f960456209995d43d53a0d7cc494a1"
      },
      {
        "id": "e4b18e19-fd0a-4cd9-abd2-b7c401dcec32",
        "name": "newtuxdev.sevielw.digikalas.online"
      },
      {
        "id": "40dd309c-7f8d-4042-964a-76292327925d",
        "name": "154.6.197.43"
      },
      {
        "id": "6cc9dd6d-27d3-425b-b935-a50ef6d23ae0",
        "name": "f324a45fcd2a9db4e542c09486c21b08bc42d6bf76fbd5f17871090361b10815"
      },
      {
        "id": "0fb0e53c-a3f2-4e18-b22d-d34244c68134",
        "name": "511d3ffb4091cbcc94571d9fb3102e8cb424c6e187d01d53ff12078d54929bda"
      },
      {
        "id": "da72d95d-8798-4d93-9b34-99d8d9b26ca4",
        "name": "0f8bcca3ed65e980da2a1f90a767b7d543be32eeea3e9338d09d4d635a497988"
      },
      {
        "id": "fd40d667-7ba1-493e-bbc4-6ee36e644ab7",
        "name": "6b7a8e0c96c2318e747f074f9a99d26738700769ac01bba692d19fc884847737"
      },
      {
        "id": "3a3a895d-4661-4103-81ef-6961e4c3d11f",
        "name": "96b1f96efca3b9df2dea85678d60da27e3265b4a00e39e20e64b27bb985e1561"
      },
      {
        "id": "abacd72c-af4a-4a39-8ff8-b9dbd42b8d48",
        "name": "api.digikalas.online"
      },
      {
        "id": "0dd6345f-797e-4f40-9515-7b53136edae7",
        "name": "cfcybernews.eu"
      },
      {
        "id": "be6a471f-383c-48c7-8fc2-959308c510e5",
        "name": "health.digikalas.online"
      },
      {
        "id": "828b10d0-4b00-48fd-bc1b-43ac14dd4c73",
        "name": "e3a5296e762e9ee16010399666441d663beeea956382e97cca032a6a5ad06811"
      },
      {
        "id": "fb1b6aa3-b80b-459e-b0f9-036e13f5de1f",
        "name": "6aa4034dc7a2858094ff4dc59af07d6fe31119591e41599bcc0f3d0b516ee734"
      },
      {
        "id": "8fe9d8f5-556a-4793-917d-e2177081fbd6",
        "name": "a03b0d41f5ef03328150331ffa0ed970998883f7e0343d79b2d3b95330d8e7c1"
      },
      {
        "id": "46afdc0d-e7ff-486f-9843-9e4141663a6d",
        "name": "a8d70d16509e227d8306be361bc37a3dc9fe34bf476f51e361e55e6d293c2b3f"
      },
      {
        "id": "e060242a-e1b3-4d3a-b535-5a3fa2f3282f",
        "name": "bd6431fb06e4689142ef597cf00382e38ae20a5393a4d9277e45a3f5b3cbcff9"
      },
      {
        "id": "1b76842a-22e9-4f6b-bc9b-61c90c5e6458",
        "name": "9cd5e7e3c8bad321ef6c3d47fe25b3b56e9487f703a7eeee52db4067e6bafe61"
      },
      {
        "id": "b42d92f6-2277-4a1e-8576-fec53750c22c",
        "name": "f1efb78887bb8783d7781c07cd13b53c9c79ebe5baa81f335838d0a6e73dec7e"
      },
      {
        "id": "2adc5d0d-ac5f-4cb6-8fee-e74f9cca907f",
        "name": "185.10.68.127"
      },
      {
        "id": "60f00e3d-62e0-47c5-b923-f79bf4c22386",
        "name": "71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d"
      },
      {
        "id": "87cae096-1928-4cce-bc2e-a4419968ac34",
        "name": "15c17dce89deccd5172285b2650de957918aa1157cde8e4633ae15dfe31f2711"
      },
      {
        "id": "50640584-2644-4075-a190-1acd0870584b",
        "name": "jetross.com"
      },
      {
        "id": "51870971-6533-469e-b6dd-01533faeece1",
        "name": "146f6010f6ee082aab13e0148d39baefa77eaba4ff65817b511b08c2092bdfd2"
      },
      {
        "id": "8c9f82ae-e55a-4f8d-8ee4-76aa445888f6",
        "name": "194.46.59.169"
      },
      {
        "id": "1037868c-5106-4d9f-a9ea-8fbb898d5247",
        "name": "digikalas.online"
      },
      {
        "id": "cc3d6cd3-36b3-4b90-a4e9-b2f18d9d41a7",
        "name": "37.32.24.195"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "52279b3d-8158-4964-8c20-9094308fcd03",
        "name": "T1110.001"
      },
      {
        "id": "da9c28df-e5f4-4cb3-92c1-06f15d8bab39",
        "name": "T1071.002"
      },
      {
        "id": "599730ac-b3e7-4d12-b633-c8e72ed71138",
        "name": "T1498.001"
      },
      {
        "id": "3b98bf45-b0e0-4070-90d0-686cbe0cd8d3",
        "name": "T1090.003"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "894026fa-e537-4b95-b612-7dd8bc367a0d",
        "name": "T1078.001"
      },
      {
        "id": "e87116ac-f56b-4b15-a5e2-a4ed737555d5",
        "name": "T1543.002"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "2e0c6db7-16a7-4bf6-992e-263474014fce",
        "name": "T1059.004"
      },
      {
        "id": "75b30f91-dcca-43a8-be70-9d50aed83203",
        "name": "T1498.002"
      },
      {
        "id": "6c31e3ae-7a24-4c3b-8a2a-f769c351a2af",
        "name": "T1568.002"
      },
      {
        "id": "4b9c2b12-37c3-4b52-a1fb-fcd8c20df2dc",
        "name": "T1574.006"
      },
      {
        "id": "05ac27d4-58d0-44b2-a984-cd5aefd1f7f9",
        "name": "T1497.001"
      },
      {
        "id": "14ea0786-b57c-4a30-8e4e-46944d17eb18",
        "name": "T1036.004"
      },
      {
        "id": "e0204523-8122-4143-a774-7a3a1a81dc38",
        "name": "T1053.003"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "ce39cd5d-9e4c-4138-b546-abd68e57f8c2",
        "name": "T1071.004"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "malware": [
      {
        "id": "9e0c3b5d-1cb1-4f28-9d51-c5cc758ccf9e",
        "name": "Kaitori",
        "slug": "kaitori"
      },
      {
        "id": "5fdcf97f-0489-477b-a5df-c662e5fc5579",
        "name": "Mirai",
        "slug": "mirai"
      },
      {
        "id": "80909043-bbd9-41b9-8164-96f40844d0ec",
        "name": "MHDDoS",
        "slug": "mhddos"
      },
      {
        "id": "73d15bb9-c597-4117-b255-490d15c9cae0",
        "name": "AISURU",
        "slug": "aisuru"
      },
      {
        "id": "f156c53d-8710-4cb4-aecc-bdfad2f45d1c",
        "name": "TuxBot v3 Evolution"
      },
      {
        "id": "b73ad55f-d23b-41e0-930c-253bc47afee5",
        "name": "Tsunami",
        "slug": "tsunami"
      },
      {
        "id": "c57af675-ee48-42b3-ae28-0e9fd72fa076",
        "name": "Gafgyt",
        "slug": "gafgyt"
      }
    ],
    "observables": [
      {
        "id": "a26a2753-5337-4004-b48c-6bcab6f5a9a8",
        "name": "cfcybernews.eu"
      },
      {
        "id": "da51eb68-2853-4d14-9a99-54d84eff50bf",
        "name": "digikalas.online"
      },
      {
        "id": "12a14995-fdae-495d-878e-c6fe34db1a34",
        "name": "jetross.com"
      },
      {
        "id": "d577b43b-e0a9-4aa3-94d3-1ce2a637a569",
        "name": "health.digikalas.online"
      },
      {
        "id": "7346b40a-c21c-442d-9254-8345ad75f7f1",
        "name": "api.digikalas.online"
      },
      {
        "id": "b2c1940e-2d98-4924-9ab6-4ef9e6a863c4",
        "name": "newtuxdev.sevielw.digikalas.online"
      },
      {
        "id": "7970d27e-4f2d-462e-a532-2e43c0f75f18",
        "name": "185.10.68.127"
      },
      {
        "id": "d9caff61-3c41-4a7f-befa-444f8c58fcd4",
        "name": "154.6.197.43"
      },
      {
        "id": "ee3b4cb7-de49-4cd2-9bcb-25d2bdcafa91",
        "name": "194.46.59.169"
      },
      {
        "id": "a0563c95-d06c-4dcc-9ee6-57717273ebbc",
        "name": "37.32.24.195"
      }
    ]
  },
  "external_refs": [
    {
      "id": "21d23531-d78f-4c7d-b2b9-11b0123a46ac",
      "standard_id": "external-reference--6439fd88-b5ab-5fd8-9b3f-d376016ca12e",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a5775d49e35f9a04532b24d",
      "hash": null,
      "external_id": "6a5775d49e35f9a04532b24d",
      "created": "2026-07-15T14:37:55.903Z",
      "modified": "2026-07-15T14:37:55.903Z",
      "createdById": null
    },
    {
      "id": "1d4b5d90-b938-462f-9e32-e68c1101c1bd",
      "standard_id": "external-reference--845c9cca-c1da-5b19-a154-5a8f8c651454",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://unit42.paloaltonetworks.com/tuxbot-v3-evolution-iot-botnet/",
      "hash": null,
      "external_id": null,
      "created": "2026-07-15T14:37:55.960Z",
      "modified": "2026-07-15T14:37:55.960Z",
      "createdById": null
    }
  ]
}