Keksec

Keksec is a cybercrime botnet operator active since at least 2016 and known for running multiple parallel malware and IoT botnet lines. The group is associated with DDoS-focused extortion and broader profit-driven operations including cryptomining, information theft, and malware deployment. Malware and botnet families linked to Keksec or its ecosystem include Gafgyt and Tsunami variants, the Python-based Necro botnet, EnemyBot, LOLFME variants, Simps, and infrastructure-linked tooling such as Kaitori and AISURU. More recent reporting also places TuxBot v3 Evolution within the broader Keksec ecosystem through shared infrastructure and tooling overlap, although that linkage is ecosystem-level rather than proof of identical codebases. Keksec has shown a pattern of rapidly operationalizing publicly disclosed vulnerabilities, especially one-day exploits, across Linux, Windows, server, and IoT environments. Reported targeting has included internet-facing enterprise applications, routers, cameras, CMS platforms, Android Debug Bridge exposures, and other embedded devices. Observed propagation methods include exploit scanning, Telnet and SSH weak-credential attacks, brute forcing, and shell-script download chains. The group has repeatedly reused and modified open-source or leaked botnet code, particularly from Mirai-, Gafgyt-, and Tsunami-related lineages, while also developing custom components such as Necro. Necro is one of the most feature-rich malware families associated with Keksec. Reported capabilities include exploit scanning, SSH brute forcing, packet sniffing, Tor-backed command and control, domain generation, web-file infection, process injection, and Windows rootkit deployment. Associated payloads and web-injection activity have also enabled credential theft, keylogging, session theft, and browser-based DDoS behavior. Across its malware portfolio, Keksec has demonstrated defense evasion through process masquerading, obfuscation, anti-analysis checks, hidden or resilient command-and-control mechanisms, and malware-killing behavior against competitors. EnemyBot and related IoT-focused tooling illustrate Keksec’s emphasis on scalable DDoS operations. EnemyBot has been linked to exploitation of numerous known vulnerabilities in routers, web servers, CMS platforms, and other exposed devices, while supporting multiple architectures and active feature development. Simps and other linked botnets further reinforce the group’s use of hybrid Mirai/Gafgyt-style code for DDoS campaigns. LOLFME-related development has also shown destructive or wiper-like logic in some variants, though confirmed operational deployment of those destructive functions has not been established. Overall, Keksec is best characterized as an organized, adaptable, financially motivated cybercrime actor centered on botnet operations, DDoS-for-hire and extortion activity, opportunistic exploitation of newly disclosed vulnerabilities, and monetization through cryptomining, malware operations, and theft-enabling payloads.