Hakai

Hakai is an IoT botnet malware family built on Gafgyt/Bashlite code and used to compromise embedded Linux devices such as routers and similar internet-exposed appliances. It has been observed in campaigns that aggressively combined multiple publicly known remote-code-execution exploits against consumer and small-office networking equipment, DVRs, NVRs, IP cameras, and related devices, with later samples adding exploitation of D-Link DSL-2750B command-injection flaws shortly after public exploit code became available. Hakai has also been associated with brute-force activity against exposed services in broader Bashlite-derived operations.

As a Bashlite-derived bot, Hakai provides backdoor-style remote command execution and is used to conscript infected devices into distributed-denial-of-service infrastructure. Related Bashlite functionality tied to the same ecosystem includes Telnet scanning, credential brute forcing, downloading and executing additional payloads, killing competing malware, and commands intended to bypass mitigation services such as Cloudflare protections. The broader code lineage also supports multiple DDoS attack modes and has been used to deploy additional malware components, including cryptocurrency miners and destructive or bot-killing payloads.

Hakai has been tracked as part of 2018 IoT malware activity that reused and extended publicly available botnet source code rather than introducing novel tradecraft. Its operational focus was rapid mass exploitation of vulnerable embedded devices for botnet growth and post-compromise use in denial-of-service operations. The malware primarily targets Linux-based IoT and network-edge systems.