Loading story…
Security researchers reported that EnemyBot, a Linux-based botnet linked to the Keksec threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from Mirai and Qbot, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting Log4j, VMware Workspace ONE, Spring Cloud Gateway, F5 BIG-IP, Adobe ColdFusion, WordPress plugins, and multiple routers and IoT products.
Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an update.sh script, which then retrieved 13 architecture-specific ELF payloads for different Linux environments. The malware attempted access to web server /shell endpoints and used common utilities such as wget, busybox, curl, and ftpget to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived LolFMe botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Securonix Threat Labs published initial coverage detailing EnemyBot as a Linux-based botnet targeting Linux systems and IoT devices via remote code execution and shell-based download-and-execute chains. The report documented an observed infection attempt using a /shell endpoint and retrieval of an update.sh script that downloaded 13 architecture-specific ELF payloads.
LevelBlue described EnemyBot as a rapidly evolving botnet attributed to Keksec that had expanded beyond IoT into Linux servers, web servers, CMS platforms, and Android devices. The report also highlighted its aggressive use of recently disclosed one-day vulnerabilities through a built-in webscan module with 24 exploits.
LevelBlue says Fortinet later published an in-depth analysis of EnemyBot after its initial discovery. The provided Fortinet reference confirms such reporting was published in April 2022.
LevelBlue states that Securonix first discovered the EnemyBot botnet in March 2022. This marks the earliest explicit identification of the malware family in the provided references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securonix.com
Open sourcelevelblue.com
Open sourcesecurityaffairs.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft and CUJO AI reported that **Zerobot**, a Go-based malware-as-a-service botnet, expanded its compromise of IoT and internet-facing systems by combining brute-force attacks on weak `SSH` and `Telnet` credentials with exploitation of more than 20 known vulnerabilities. The malware targeted routers, firewalls, IP cameras, web servers, and enterprise software, with observed exploitation including `CVE-2021-42013` in Apache, `CVE-2022-33891` in Apache Spark, **Spring4Shell**, and **F5 BIG-IP** flaws. Researchers said the botnet delivered architecture-specific binaries or a `zero.sh` script from attacker-controlled infrastructure and added infected devices to a distributed denial-of-service network. The newer **Zerobot 1.1** variant added multiple DDoS attack methods, Linux and Windows-capable samples, and persistence mechanisms for both platforms, while also attempting to remove rival malware such as **Mozi**, **Kaiten**, **Sora**, **Phantom**, **Nbrute**, and `minerd`. Investigators linked activity to infrastructure including the domain `zero.sudolite.ml` and IP addresses `176.65.137.5` and `176.65.137.6`, and noted that one associated domain was reportedly among domains tied to DDoS-for-hire services seized by the FBI. Researchers also found some exploit routines were malformed or mislabeled, suggesting the botnet was still under active development even as it broadened propagation and evasion behavior.
Aug 15, 2026
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
Palo Alto Networks Unit 42 reported on **TuxBot v3 Evolution**, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across **17 CPU architectures**. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and **254 DDoS benchmark reports**, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with **1,496 credentials**, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping. The report said the framework appears to have been developed with heavy **LLM assistance**, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake `Argon2id` routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at `209.182.237[.]133` and a dropper at `185.10.68[.]127`, with reported ties to the **Keksec/Kaitori** and **AISURU** ecosystems.
Jul 21, 2026