TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

MITRE Techniques

• [T1078 ] Valid Accounts – The bot brute-forces Telnet access using 1,496 credential pairs against targeted devices (‘The bot agent brute-forces Telnet access on targeted devices with 1,496 credential pairs’).
• [T1110.001 ] Brute Force: Password Guessing – It attempts large-scale login guessing over Telnet, SSH, HTTP, and ADB scanners (‘scanners (Telnet, SSH, HTTP, PHP-based application, ADB)’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – The bot uses HTTP polling and HTTP-based exploit/scanning traffic (‘HTTP polling’, ‘the HTTP scanner operates as an isolated child process’).
• [T1071.003 ] Application Layer Protocol: Mail Protocols – It uses IRC as a fall-back C2 channel for commands (‘IRC’, ‘joins a channel (default #tuxbot)’).
• [T1095 ] Non-Application Layer Protocol – The primary C2 uses encrypted TCP communications with custom packet framing (‘The bot connects to the C2 server on TCP port 1999 … Each encrypted packet has the following format’).
• [T1027 ] Obfuscated Files or Information – Sensitive strings are XOR-encrypted and decrypted at runtime (‘TuxBot stores sensitive strings … in an XOR-encrypted table that it decrypts at runtime’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – The competitor killer scans for rival malware and kills matches (‘Scans of /proc for memory signatures of Mirai, QBOT, Vamp, Anime and dvrHelper’).
• [T1014 ] Rootkit – The bot hides its process name and uses stealth mechanisms to evade notice (‘Hiding its process name’, ‘Stealth (process mimicry/relocation/anti-VM)’).
• [T1112 ] Modify Registry – Not mentioned.
• [T1090 ] Proxy – The bot includes a SOCKS5 proxy as part of its subsystem set (‘A SOCKS5 proxy’).
• [T1496 ] Resource Hijacking – The framework includes a mining placeholder (‘The mining placeholder’).
• [T1498 ] Network Denial of Service – It implements multiple flood-based attack handlers and DDoS-for-hire functions (‘attack_udp_generic_optimized’, ‘attack_tcp_syn_optimized’, ‘DDoS-for-hire panel’).
• [T1059 ] Command and Scripting Interpreter – The C2 panel accepts operator commands like !method target duration (‘issue attack commands in the format !method target duration’).
• [T1021.004 ] Remote Services: SSH – The C2 server exposes an SSH admin shell on TCP 2222 (‘The second listener is an SSH server on TCP port 2222 that presents an interactive shell for operators’).
• [T1204 ] User Execution – Not mentioned.
• [T1211 ] Exploitation for Defense Evasion – The bot includes exploit code targeting more than 30 IoT device families (‘contains exploit code targeting more than 30 IoT device families’).
• [T1021.001 ] Remote Services: Telnet – Telnet is used as the primary infection vector (‘brute-forces Telnet access’).
• [T1027.004 ] File and Directory Discovery – The anti-VM logic checks DMI, MAC prefixes, and tools in the environment (‘DMI file checks for VMware/VirtualBox/QEMU’, ‘Checks for running analysis tools’).
• [T1046 ] Network Service Scanning – The bot includes scanners and brute-force web probing against services (‘Telnet, SSH, HTTP, PHP-based application, ADB’).