TuxBot v3 botnet targets IoT devices across 17 architectures

Palo Alto Networks Unit 42 described TuxBot v3 Evolution as a previously undocumented modular IoT botnet framework with working infection, persistence, encrypted command-and-control, and DDoS capabilities across 17 CPU architectures. Researchers recovered source code, compiled binaries, Docker-based test infrastructure, and 254 DDoS benchmark reports, indicating active development and testing into early 2026.

The malware can brute-force Telnet with 1,496 credentials and scan over SSH, HTTP, and ADB, while relying on fallback mechanisms including a domain generation algorithm and peer-to-peer gossiping. Unit 42 said heavy LLM assistance appears to have shaped the framework and introduced flaws such as a broken XOR string table, a nonfunctional exploit virtual machine, and a fake Argon2id routine that behaves like repeated SHA-256 hashing similar to PBKDF2.

Despite those defects, core infection and DDoS functions remain usable, and the flaws were assessed as relatively easy to fix. Telemetry tied activity to a command-and-control server at 209.182.237[.]133 and a dropper at 185.10.68[.]127, with reported links to the Keksec/Kaitori and AISURU ecosystems.