Loading malware…
Tsunami, also widely known as Kaiten, is a long-running UNIX and Linux malware family primarily used as an IRC-controlled botnet and backdoor. First seen in the early 2000s, it has persisted through numerous variants and forks and has been repeatedly repurposed by multiple threat actors targeting Linux servers, Linux-based IoT devices, routers, DVRs, and containerized or cloud-hosted workloads. Variants such as Ziggy and Muhstik have been observed in active campaigns, and the family has also been incorporated into operations by actors including TeamTNT and Keksec.
Its core functionality combines remote command execution with distributed denial-of-service capability. Tsunami commonly allows operators to execute shell commands, download and run additional payloads, gather basic host information, and participate in flooding attacks such as SYN, ACK, and UDP-based DDoS. In many campaigns it serves as a secondary payload or persistent foothold alongside cryptominers, credential theft tooling, rootkits, or other malware. Some observed deployments used Tsunami to further deliver miners, while other campaigns paired it with SSH propagation scripts, log cleaners, and persistence mechanisms.
Tsunami is strongly associated with Linux-focused intrusion activity. Delivery has been observed through brute-force attacks against weak SSH credentials, exploitation of internet-facing vulnerabilities, abuse of exposed Docker and cloud services, and deployment from malicious container images. It has been dropped after compromises involving web applications, middleware, and cloud-native infrastructure, including campaigns exploiting vulnerabilities such as Log4Shell and exposed Apache RocketMQ instances through Muhstik-related activity. TeamTNT has repeatedly used Tsunami in campaigns against Docker, Kubernetes, Redis, Jupyter, Weave Scope, and other exposed services, often combining it with cryptojacking and credential theft. Keksec has also maintained and modified Tsunami as one of its principal botnet families.
The family has evolved beyond simple IRC bot behavior in some newer or distinct frameworks using the same name. A more recent modular malware framework identified as Tsunami has been associated with North Korea-linked developer targeting activity and includes browser credential theft, session and cookie theft, keylogging, secret file theft, exfiltration, botnet functionality, and bundled cryptominers, with command and control mediated through Tor and intermediary services. Because the name has been reused across substantially different implementations, analysts should distinguish the classic Kaiten/Tsunami Linux botnet lineage from newer modular malware frameworks that share the Tsunami name.
Across its better-established Linux botnet lineage, Tsunami remains notable for its longevity, code reuse, ease of modification, and continued operational value as a lightweight backdoor and DDoS bot in opportunistic campaigns against poorly secured internet-facing systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
there are credible reports from other sources that several automated botnets (such as Mirai, Tsunami, and Kinsing) have begun to exploit it as well
The Muhstik botnet exploits Drupal vulnerability (CVE-2018-7600), impacting versions 6,7, and 8 of Drupal’s CMS platform.
The downloaded payload (md5: aec2df8a6cb35aa5b01b0d9f1f879aa1) is an x86_64 ELF executable that was submitted to VirusTotal and detected by many vendors as Tsunami/Kaiten. It mainly functions as a DDoS client, but also has backdoor capabilities, communicating over IRC.
The downloaded payload (md5: aec2df8a6cb35aa5b01b0d9f1f879aa1) is an x86_64 ELF executable that was submitted to VirusTotal and detected by many vendors as Tsunami/Kaiten. It mainly functions as a DDoS client, but also has backdoor capabilities, communicating over IRC.
"Tsunami, a Linux-based malware used primarily for Distributed Denial of Service (DDoS) attacks, is also a key component of both infection chains."
Currently, there are few samples and the following vulnerabilities are exploited. CVE_2020_14882
"Tsunami, a Linux-based malware used primarily for Distributed Denial of Service (DDoS) attacks, is also a key component of both infection chains."
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Keksec actively maintains three main families, Gafgyt, Tsunami and Necro, with new features constantly being added.
Further, it makes a bunch of references to a TSUNAMI payload which STRIKE hasn’t analyzed, and its role is unknown.
The elf binary is also executed from memory. It is classified in VirusTotal as Tsunami malware (MD5=48c056a1bf908a424d472f121ccaf44b), something often used in TeamTNT’s other campaigns. Tsunami malware enables a remote attacker to download files and execute shell commands in an infected host.
During our analysis we were able to identify a more comprehensive sample of the Tsunami-Framework, a Malware relying on the TOR-Network and Pastebin for command and control. Tsunami has a modular structure, incorporates multiple stealers and deploys two cryptominers.
“bi.64 -> Tsunami… Tsunami is a popular botnet that controls and communicates through the IRC protocol. Its main functions include remote control and DDoS attacks.”
Listed in several Lazarus/BeaverTail/InvisibleFerret related items as “tsunami,” including “Lazarus Tsunami InvisibleFerret.”
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Based on our research, we have discerned that this botnet perpetually scans the entirety of the internet... every IP address undergoes a scan at least once every hour.
We can see that Keksec launched scans and attacks on targets across the network almost non-stop. Our honeypots see new variants and exploits all the time, with the exception of some occasional breaks. When a new exploit is introduced, the scans increase significantly.
During this campaign, the threat actor focused on compromising unprotected Redis servers... It’s using Redis’s FLUSHALL issue to create a cron job that downloads a setup script. | The default configuration of standard Kubernetes deployments allow anonymous access to kubelet. TeamTNT used this misconfiguration to gain access to exposed Kubernetes instances and run cryptomining malware in the containers. | TeamTNT targeted Docker daemon ports and abused them to install cryptomining malware and DDoS malware... the script uses the exposed port to spawn a new container from the Alpine image.
Hadooken, in turn, drops and executes a cryptominer and the Tsunami malware and then sets up multiple cron jobs with randomized names and payloads execution frequencies.
It then adds a Windows-Defender Exclusion for the “Runtime Broker.exe” and creates a Scheduled Task for secondary persistence.
T1059 Command and Scripting Interpreter Multiple stages rely on Scripting Interpreters like JavaScript, PowerShell and Python.
In terms of execution and the download command is a bash implementation used to download scripts and binaries from the C2 server.
When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.
Hadooken, in turn, drops and executes a cryptominer and the Tsunami malware and then sets up multiple cron jobs with randomized names and payloads execution frequencies.
When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.
Hadooken, in turn, drops and executes a cryptominer and the Tsunami malware and then sets up multiple cron jobs with randomized names and payloads execution frequencies.
It then adds a Windows-Defender Exclusion for the “Runtime Broker.exe” and creates a Scheduled Task for secondary persistence.
in a fileless malware attack, the malware is loaded into memory and then executed. By executing malicious code directly from memory, attackers can evade detection by static scanners
Most of the Gafgyt and Tsunami samples we captured were not packed... String encoding... Necro also cryptographically protects the string by first performing character substitution and then doing zip compression.
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
The scanners used by Keksec are mainly telnet and SSH weak password scan and exploit scan.
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
Necro first tries to install the paramiko library on the device, and if it succeeds, it adds port 22 to the list of scanned ports... Necro added the SMB scan code in one of its versions to achieve the function of horizontal propagation in the intranet.
Keksec’s malware mainly uses Gafgyt and IRC protocols to send commands.
The IRC protocol is the most widely used protocol in Keksec, and is supported by the Tsunami, Necro and DarkIRC families.
T1496.001 Resource Hijacking: Compute Hijacking Multiple Cryptominers are deployed by the malware
198 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
40 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a dropper referenced in inactive remote-code-execution code within the analyzed TuxBot ecosystem.
Referenced as inherited code/dead-code lineage within TuxBot’s source, indicating reused payload logic from the Tsunami codebase.
A named malware family included in the report tags related to Linux SSH server threats.
Referenced as a Linux botnet family known for using altered UPX magic bytes in packed ELF32 binaries.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.