New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai-Style DDoS Attacks
Nozomi Networks identified KATARU, a new Mirai-style IoT botnet delivered via Telnet brute force that uses Linux privilege-escalation exploits and encrypted C2 for DDoS floods.
Nozomi Networks identified KATARU in August after a Telnet password-guessing attack against a honeypot retrieved an ARM payload. The malware attempts exploits for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape, and persists via systemd services, cron tasks, rc scripts, OpenWrt hooks, and Android boot locations. Its C2 uses X25519 key exchange with ChaCha20-Poly1305 encryption and supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, plus SSH brute forcing and command execution; embedded exploit shellcode in the ARM build targeted x86, suggesting untested copied code.
- Delivered by Telnet password guessing; uses BusyBox commands to fetch an ARM payload
- Attempts exploits for CVE-2026-46300, CVE-2026-43284, CVE-2026-31431 and a cgroup v1 escape
- ChaCha20-Poly1305 encrypted C2 over X25519 supports TCP, UDP, ICMP, HTTP, QUIC, DNS floods
- Persists via systemd, cron, rc scripts, OpenWrt hooks and Android boot locations
- ARM build's exploit shellcode targets x86, indicating copied but untested code
- ATT&CK
- T1110.001 Password GuessingT1068 Exploitation for Privilege EscalationT1053.003 CronT1573.002 Asymmetric Encrypted ChannelT1498.001 Direct Network Flood
- Vendors
- Nozomi Networks
- Organizations
- Nozomi Networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-31431 | Local Privilege Escalation (Copy Fail) in Linux Kernel algif_aead Interface | 7.8 | 98% | KEVPoC ×12 | KEV |
| CVE-2026-43284 | Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123) | 8.8 | 94% | PoC | |
| CVE-2026-46300 | Shared-frag marker loss in Linux kernel skb coalescing (LPE) | 7.8 | 16% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 160.191.242.92 | fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 sample IP address 160[.]191.242.92 Observed Telnet credential-brute-force source and C2 infr |
| sha256 | 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 | 056e3a9218 Loader or closely related loader variant SHA-256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload SHA-256 6fbae3505ae0d638b820165c572d54 |
| sha256 | 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f | ec254d98b876e59692b5fa22abc1d4 KATARU ARM32 payload SHA-256 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f KATARU ARM32 sample SHA-256 9d87e6615c810907443ebd5e915f3b3 |
| sha256 | 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 | 99c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 sample SHA-256 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 KATARU AMD64 sample IP address 160[.]191.242.92 Observed Te |
| sha256 | 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc | 92dda71e82dc47e8efe13f30617f35f KATARU ARM32 sample SHA-256 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc KATARU ARM32 sample SHA-256 9d7cd4948a1fcbaeadc425752fce9a9 |
| sha256 | cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 | and executed after Telnet credential brute forcing SHA-256 cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 Loader or closely related loader variant SHA-256 13382c16e2 |
From the original article
4 min read at cybersecuritynews.com
KATARU is a newly observed IoT malware strain that can turn poorly secured devices into DDoS attack nodes. The sample was captured after an attacker used repeated Telnet password guesses against a honeypot, then downloaded an ARM payload. It shows how old entry points still give attackers a foothold.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.