New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks
Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.
Nozomi Networks identified KATARU in August after a Telnet password-guessing attack against a honeypot retrieved an ARM payload. The malware attempts exploits for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape, and persists via systemd services, cron tasks, rc scripts, OpenWrt hooks, and Android boot locations. Its C2 uses X25519 key exchange with ChaCha20-Poly1305 encryption and supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, plus SSH brute forcing and command execution; embedded exploit shellcode in the ARM build targeted x86, suggesting untested copied code.
- Delivered by Telnet password guessing; uses BusyBox commands to fetch an ARM payload
- Attempts exploits for CVE-2026-46300, CVE-2026-43284, CVE-2026-31431 and a cgroup v1 escape
- ChaCha20-Poly1305 encrypted C2 over X25519 supports TCP, UDP, ICMP, HTTP, QUIC, DNS floods
- Persists via systemd, cron, rc scripts, OpenWrt hooks and Android boot locations
- ARM build's exploit shellcode targets x86, indicating copied but untested code
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface CVE-2026-31431 ('Copy Fail') is an incorrect resource transfer between spheres (CWE-669/CWE-1288) in the Linux kernel's algif_aead implementation of the AF_ALG userspace crypto interface, introduced roughly nine years ago (around 2017, per public reporting) when commit 72548b093ee3 switched AEAD operations to in-place handling even though the source and destination buffers come from different mappings. A local, unprivileged user can trigger the flaw by performing AEAD operations through the AF_ALG socket interface, causing the kernel to mishandle the copy of ciphertext and associated data. Successful exploitation provides a reliable local privilege escalation to root (C:H/I:H/A:H per the CVSS vector). Nearly every major Linux distribution and enterprise platform is exposed, including the kernel itself, Red Hat Enterprise Linux (including AUS, EUS, TUS and Update Services for SAP Solutions), OpenShift Container Platform, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Linux-based products from Arista and Siemens. The flaw has public proof-of-concept code, a 99.9% EPSS score, and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-05-01, indicating exploitation in the wild (ransomware use is unknown). Do: Patch by installing the kernel update for CVE-2026-31431 through your distribution's security channel (Red Hat Enterprise Linux including AUS/EUS/TUS/SAP channels, OpenShift, Amazon Linux, Ubuntu, Debian, openSUSE Leap, SUSE CaaS Platform, NixOS, and Arista/Siemens firmware/software as applicable) and reboot into the patched kernel; the data provides no fixed version numbers, so defer to vendor advisories. Because the flaw is in CISA's KEV catalog (added 2026-05-01) with a 99.9% EPSS score, prioritize internet-reachable and multi-user systems first and follow BOD 22-01 guidance for cloud services. Check running kernel versions ('uname -r') and distribution advisory status to confirm you are on a fixed build. | 7.8 | 100% | KEV PoC ×5 |
| masshundreds of millions to billions of installations (servers, cloud instances, desktops, and Android/embedded devices running affected kernel generations) | |
| CVE-2026-43284 | Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123) CVE-2026-43284 is a write-what-where memory-safety flaw (CWE-123) in the Linux kernel's xfrm/ESP (IPsec) code: the IPv4/IPv6 UDP datagram send paths fail to mark pages spliced into a UDP skb with SKBFL_SHARED_FRAG when MSG_SPLICE_PAGES attaches pipe pages, so the ESP input path wrongly treats the packet as privately owned and decrypts it in place over memory the skb does not exclusively own. It is triggered when locally generated UDP traffic built from spliced pipe pages is processed by the ESP decryption path, typically in IPsec NAT-traversal (ESP-in-UDP, UDP port 4500) configurations; the in-place decrypt can corrupt or expose data still referenced by the pipe or other owners of those shared pages. A local, low-privileged attacker can thereby cause high-severity confidentiality, integrity, and availability impact that extends beyond the packet itself (CVSS 3.1: 8.8, scope changed); no remote or unauthenticated trigger is described. Any Linux system running a kernel with the vulnerable UDP splice and ESP-in-UDP paths is affected, most importantly IPsec VPN gateways and clients; the advisory lists no affected version ranges. No public proof-of-concept or confirmed in-the-wild exploitation is known (not on CISA KEV), but EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), so patching should not be deferred. Do: Apply your distribution's kernel security update containing the xfrm/esp fix for CVE-2026-43284 and reboot into the patched kernel, prioritizing IPsec VPN gateways and clients that use ESP-in-UDP NAT-T (UDP/4500). Until patched, restrict untrusted local users from sending splice-based (MSG_SPLICE_PAGES) UDP traffic through IPsec-protected paths, or temporarily avoid ESP-in-UDP encapsulation where feasible. Verify the fix via your vendor's package changelog, as the advisory does not name specific fixed version numbers. | 8.8 | 93% |
| mass≈1M+ Linux installations carry the vulnerable code in default distro kernels; hundreds of thousands of hosts expose IPsec NAT-T (UDP/4500) in public internet… | ||
| CVE-2026-46300 | In the Linux kernel, the following vulnerability has been resolved: In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. NVD description · AI analysis pending | 7.8 | 9% |
| — |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| sha256 | 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 | 056e3a9218 Loader or closely related loader variant SHA-256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload SHA-256 6fbae3505ae0d638b820165c572d54 |
| sha256 | 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f | ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload SHA-256 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f KATARU ARM32 sample SHA-256 9d87e6615c810907443ebd5e915f3b3 |
| sha256 | 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 | 99c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 sample SHA-256 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 sample IP address 160[.]191.242.92 Observed Te |
| sha256 | 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc | 92dda71e82dc47e8efe13f30617f35f KATARU ARM32 sample SHA-256 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 sample SHA-256 9d7cd4948a1fcbaeadc425752fce9a9 |
| sha256 | cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 | and executed after Telnet credential brute forcing SHA-256 cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 Loader or closely related loader variant SHA-256 13382c16e2 |
Full article825 words · extracted from cybersecuritynews.com · click to collapse
KATARU is a newly observed IoT malware strain that can turn poorly secured devices into DDoS attack nodes. The sample was captured after an attacker used repeated Telnet password guesses against a honeypot, then downloaded an ARM payload.
It shows how old entry points still give attackers a foothold. The malware resembles the Mirai botnet family in its ability to flood targets with traffic, but carries wider tools.
It can attempt to gain root access, stay active through reboots, hide command traffic, and run commands supplied by its operators. A compromised device can therefore be harder to remove and more useful in attacks.
Analysts at Nozomi Networks identified the sample in August and named the family KATARU after a ChaCha20 nonce used to decrypt its configuration.
Nozomi Networks said in a report shared with Cyber Security News (CSN) that its code appears assembled from public examples and possibly AI-assisted material, yet its working features remain concerning.
.webp)
For network owners, the immediate problem is exposure. Devices with Telnet enabled, weak credentials, old firmware give operators a path in. As Mirai botnets and proxy abuse have shown, IoT infections can scale quickly when basic device security is neglected.
New KATARU IoT Malware
KATARU begins with Telnet credential brute forcing, then uses BusyBox commands to retrieve and execute a payload. Once running, it checks whether /etc/passwd is writable and tries to remove the root password placeholder.
It then attempts public code for CVE-2026-46300, Fragnesia; CVE-2026-43284, DirtyFrag; and CVE-2026-31431, Copy Fail. The code also attempts a cgroup v1 release_agent escape that can relaunch the malware with higher privileges.
In the analyzed ARM build, however, embedded exploit shellcode targeted x86 systems. It suggests code was copied without full testing, but remains dangerous.
Root access would give the malware greater control and make cleanup harder. KATARU tries to persist through systemd services, cron tasks, rc scripts, OpenWrt hooks, package-management hooks, and Android boot locations.
.webp)
It may mark copies immutable or append-only when permissions allow, requiring close incident-response review. Its persistence logic spans Linux, routers, desktops, and Android.
Administrators should patch supported firmware and kernels, remove unnecessary Telnet access, and replace default or weak passwords. Actively exploited Linux kernel flaws show why escalation bugs demand attention after a breach.
Encrypted C2 enables DDoS attacks
KATARU does not use the plain-text control traffic associated with older Mirai variants. Each device creates an X25519 key pair and uses a shared secret to protect commands with ChaCha20-Poly1305 encryption.
It hinders casual inspection and server impersonation, although its pinned public key matches an RFC test value. The malware supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, including attacks aimed at Minecraft, FiveM, OpenVPN, and WireGuard.
It can brute-force SSH, download additional binaries through wget, execute shell commands, stop active floods, and remove its files. SSH attacks are command-server tasks, not autonomous spreading.
A decoy component further muddies analysis with fake web requests and IRC-style chatter. It includes strings resembling Mirai or Katana labels although code does not use them.
Teams should validate telemetry before blocking infrastructure, as decoys mix documentation addresses with legitimate services. Defenders should isolate IoT and operational technology devices, allowing only required management and business traffic.
Monitor unfamiliar outbound encrypted connections, packet spikes, Telnet or SSH attempts, and startup-file changes. Network teams should also retain logs long enough to compare a device’s current behavior with its normal traffic patterns.
Coverage of TuxBot LLM-generated botnet code also shows why basic hardening matters. These controls cannot ensure every device is safe where vendors no longer issue updates.
Where updates cannot be installed, organizations should consider retiring devices or placing them behind tightly controlled access paths, because unsupported equipment leaves known weaknesses exposed for years on the internet.
They reduce the chance that one device becomes a durable foothold or joins a flood. Inventory connected equipment, restrict remote administration, and investigate unusual outbound activity before it becomes a wider service disruption.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| File name | vlxx.arm | ARM payload retrieved and executed after Telnet credential brute forcing |
| SHA-256 | cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 | Loader or closely related loader variant |
| SHA-256 | 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 | KATARU ARM32 payload |
| SHA-256 | 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f | KATARU ARM32 sample |
| SHA-256 | 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc | KATARU ARM32 sample |
| SHA-256 | 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 | KATARU AMD64 sample |
| IP address | 160[.]191.242.92 | Observed Telnet credential-brute-force source and C2 infrastructure |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/new-kataru-iot-malware/