ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Malware

KATARU

2 mentions in 7 days · 2 in 30 days · 2 total · first seen · last

Search everything

Timeline

New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks

Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.

Nozomi Networks identified KATARU in August after a Telnet password-guessing attack against a honeypot retrieved an ARM payload. The malware attempts exploits for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape, and persists via systemd services, cron tasks, rc scripts, OpenWrt hooks, and Android boot locations. Its C2 uses X25519 key exchange with ChaCha20-Poly1305 encryption and supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, plus SSH brute forcing and command execution; embedded exploit shellcode in the ARM build targeted x86, suggesting untested copied code.

Cyber Security News · 4d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Nozomi details KATARU, an IoT botnet that brute-forces Telnet, exploits public Linux kernel flaws for root access, and launches multi-protocol DDoS attacks.

KATARU, discovered after honeypot Telnet brute-force activity from a Vietnamese IP, downloads an ARM payload (vlxx.arm) and attempts privilege escalation by editing /etc/passwd or exploiting CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail). It combines Mirai-style TCP, UDP, ICMP, HTTP, QUIC and DNS floods with application attacks against Minecraft, FiveM, OpenVPN and WireGuard. The malware uses X25519 and ChaCha20-Poly1305 encrypted C2, unusually broad persistence across systemd, cron, init frameworks, and Android hooks, plus anti-debugging and decoy traffic to hinder analysis. Implementers copied x86 shellcode into the ARM binary and reused an RFC 7748 test-vector key, indicating low-quality but rapidly evolving commodity development.

GBHackersupdated · 4d agofirst · 4d agoMalware in the wild 2 sourcesCVE-2026-46300CVE-2026-43284CVE-2026-31431

Related CVEs

  • CVE-2026-314317.8100%
    Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface
    CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown).
    · Linux kernel (algif_aead / AF_ALG crypto interface) · Red Hat Enterprise Linux (including AUS, EUS, TUS, and Update Services for SAP Solutions) KEV PoC ×5mass
  • CVE-2026-432848.893%
    Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123)
    CVE-2026-43284 is a write-what-where memory-safety flaw (CWE-123) in the Linux kernel's xfrm/ESP (IPsec) code: the IPv4/IPv6 UDP datagram send paths fail to mark pages spliced into a UDP skb with SKBFL_SHARED_FRAG when MSG_SPLICE_PAGES attaches pipe pages, so the ESP input path wrongly treats the packet as privately owned and decrypts it in place over memory the skb does not exclusively own. It is triggered when locally generated UDP traffic built from spliced pipe pages is processed by the ESP decryption path, typically in IPsec NAT-traversal (ESP-in-UDP, UDP port 4500) configurations; the in-place decrypt can corrupt or expose data still referenced by the pipe or other owners of those shared pages. A local, low-privileged attacker can thereby cause high-severity confidentiality, integrity, and availability impact that extends beyond the packet itself (CVSS 3.1: 8.8, scope changed); no remote or unauthenticated trigger is described. Any Linux system running a kernel with the vulnerable UDP splice and ESP-in-UDP paths is affected, most importantly IPsec VPN gateways and clients; the advisory lists no affected version ranges. No public proof-of-concept or confirmed in-the-wild exploitation is known (not on CISA KEV), but EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), so patching should not be deferred.
    · Linux kernelmass
  • CVE-2026-463007.89%
    In the Linux kernel, the following vulnerability has been resolved:
    In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags…
    · linux linux kernel—

Appears with

malware Mirai 1organization Nozomi 1organization Nozomi Networks 1product BusyBox 1product KATARU 1product Mirai 1product OpenWrt 1vendor Linux 1vendor Nozomi 1vendor Nozomi Networks 1vendor OpenWrt 1vendor WireGuard 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.