Kaiten

Kaiten, also widely known as Tsunami, is a long-running Linux IRC bot and DDoS malware family that has been extensively reused, modified, and embedded into broader botnet operations targeting internet-exposed devices and servers. It is commonly associated with compromised Linux and IoT systems, including routers, cameras, embedded appliances, cloud workloads, containers, and other Unix-like environments. The malware is typically deployed after opportunistic compromise through exposed services, weak credentials, or exploitation of known vulnerabilities, and then connects to operator-controlled IRC infrastructure to receive commands.

Kaiten’s core role is as an IRC-controlled backdoor with distributed denial-of-service functionality. Variants and descendants support multiple flooding techniques and remote command execution, allowing operators to use infected hosts both for DDoS activity and for general post-compromise control. In multiple observed campaigns, Kaiten-derived bots have also been used alongside cryptominers or other payloads, reflecting its role as a modular secondary payload in Linux intrusion chains.

The family has been repeatedly incorporated into IoT botnets and malware ecosystems adjacent to Mirai and Gafgyt/Bashlite. It has appeared as a competitor process explicitly terminated by other botnets seeking exclusive control of infected devices, indicating its continued prevalence in the Linux/IoT botnet landscape. Modified Kaiten variants have also been observed using default credentials relevant to operational technology and industrial control environments, showing that generic botnet operators have adapted Kaiten-based tooling to opportunistically target exposed OT-capable devices as well.

Kaiten has also served as a code base for later malware. TeamTNT used IRC bots based on Kaiten in cloud- and container-focused campaigns, and other Linux worms and botnets have been described as based on or derived from Kaiten. In Docker-focused intrusions, Kaiten variants have been dropped together with cryptocurrency miners and persistence scripts. Across these uses, the malware remains notable less as a single modern strain than as a durable IRC bot lineage that continues to be repurposed for Linux botnet operations, DDoS attacks, persistence within compromised environments, and remote shell-style control.