Loading threat actor…
Kaitori is a threat actor name associated with botnet-related activity and infrastructure overlap involving Linux-based internet-connected devices. It has been linked through shared hosting and certificate artifacts to broader activity associated with Keksec and AISURU. The available evidence supports infrastructure association rather than a confirmed one-to-one malware-family identity. Kaitori-related activity is associated with IoT botnet operations focused on compromising exposed Linux devices such as routers and cameras and using them for distributed denial-of-service attacks. Observed tradecraft in the linked activity includes scanning and probing of exposed services, password-guessing against remote administration interfaces, exploitation of vulnerable devices, encrypted command-and-control communications, persistence on compromised systems, process disguise, and removal of competing malware. The linked botnet activity also demonstrates operational flooding capabilities across multiple protocols and broad support for diverse processor architectures common in embedded environments. Kaitori should be understood as part of a cluster of closely related botnet activity rather than a fully delineated standalone malware family based on the currently available evidence. High-confidence reporting supports association with shared infrastructure and DDoS-oriented botnet operations, but does not conclusively establish the full scope, origin, or distinct tooling boundaries of the actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
28 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
12 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.