New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

A newly observed IoT malware family dubbed KATARU targets internet-exposed devices through Telnet credential brute-forcing, then attempts to gain root privileges with publicly available Linux kernel exploits before enrolling compromised systems in a DDoS botnet.

The sample combines familiar Mirai-style flooding functions with encrypted command-and-control, broad persistence logic, anti-analysis checks and decoy network activity designed to complicate incident response.

Following successful access, the operator used BusyBox commands to download and execute an ARM payload named vlxx.arm, with SHA-256 hash 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4.

Staging markers including condi72 and condixx link the delivery flow to a basic loader believed to be related to previously public dropper code.

KATARU’s defining feature is its attempt to turn initial, low-privilege access into full root control.

The malware first checks whether /etc/passwd is writable; if it is, KATARU modifies the root:x: entry to root::, potentially allowing passwordless use of su.

If that shortcut fails, it attempts multiple Linux local privilege-escalation exploits derived from public proof-of-concept code.

These include CVE-2026-46300, known as Fragnesia, which affects Linux kernel XFRM ESP-in-TCP processing and can enable a local attacker to modify page-cache-backed read-only files and escalate privileges.

The malware also embeds code associated with the Dirty Frag vulnerabilities, including CVE-2026-43284, and the Copy Fail flaw, CVE-2026-31431.

Both vulnerability families have been documented as local root-escalation risks affecting Linux kernel networking or cryptographic subsystems.

However, analysis shows that the ARM KATARU binary contains x86-oriented shellcode within its privilege-escalation routines.

That mismatch strongly indicates the authors copied exploit material without adequately porting or testing it for the device architecture.

The flaw does not make the malware harmless: attackers can still succeed against misconfigured systems or selectively deploy working variants for target hardware.

After execution, KATARU discovers its running path through /proc/self/exe and copies itself into candidate filesystem locations.

Where privileges permit, it can alter file attributes, overwrite targets and apply immutable or append-only flags to impede removal.

Its persistence coverage is unusually expansive. The malware attempts to abuse systemd services, timers, generators and path units; cron jobs and @reboot; rc.local; SysV init files; shell profiles.

Nozomi said in a report shared with GBhackers, the malware was identified after a honeypot received brute-force Telnet activity from an IP address in Vietnam.

IoT Malware Attack

OpenWrt hotplug and procd mechanisms; U-Boot and NVRAM hooks; DHCP, udev and package-manager scripts; alternative init frameworks including OpenRC, runit, s6 and dinit; and XDG desktop autostart locations.

It also contains Android-oriented logic, checking boot-script locations associated with rooted Android systems and attempting to create an init service launched after boot completion.

This “try everything” persistence model gives the botnet opportunities to survive reboot on routers, embedded Linux devices, industrial appliances, Linux hosts and potentially modified Android endpoints.

KATARU departs from the plain-text communications common in older Mirai derivatives.

It uses an X25519 key exchange and ChaCha20-Poly1305 encrypted, authenticated message frames to communicate with its command-and-control infrastructure.

The design can make passive traffic inspection and C2 impersonation more difficult.

A notable implementation error is that its embedded pinned X25519 public key matches Alice’s public key from the RFC 7748 test vectors an artifact consistent with copied reference code rather than production-grade cryptographic key management.

Once controlled, infected devices can launch TCP, UDP, ICMP, HTTP, QUIC and DNS floods.

KATARU also includes attacks aimed at Minecraft, FiveM, OpenVPN and WireGuard services, along with an SSH brute-force function using embedded credentials.

C2 operators can additionally order bots to download and run second-stage payloads, execute shell commands, conduct UDP throughput tests, stop active attacks or remove the malware and its persistence artifacts.

The malware includes anti-debugging checks for ptrace, TracerPid, LD_PRELOAD, Valgrind, radare2-related environment variables and analyst tool process names.

It also uses a timing check intended to detect debugging or instrumented execution.

KATARU further emits fake beacon traffic, synthetic HTTP requests, misleading JWT data, decoy hostnames, IRC-style chatter and junk UDP packets.

Some decoy destinations use RFC documentation address ranges, while others point to legitimate third-party infrastructure.

Analysts should therefore avoid treating every hostname, IP address or string embedded in the binary as a confirmed indicator of compromise.

Organizations should disable Telnet wherever possible, eliminate default credentials, restrict device administration to segmented management networks or VPNs, and patch supported device firmware and Linux kernels.

The Fragnesia, Dirty Frag and Copy Fail issues demonstrate why low-privilege footholds can become root-level compromise on vulnerable systems.access.

Defenders should also monitor for unauthorized systemd units, cron jobs, altered boot scripts, OpenWrt hooks, unexpected immutable files, unusual outbound encrypted connections and sudden high-volume traffic from IoT assets.

KATARU shows how rapidly commodity botnets can combine public exploits, copied code and AI-assisted development into a disruptive threat even when their implementation remains noisy and imperfect.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.