Kairos DDoS botnet opens idle TCP sessions from Linux hosts
Original title: New Kairos DDoS Botnet Hijacks Linux Devices to Overwhelm Servers With Thousands of TCP Connections
Nozomi says the Go bot arrives over Telnet with an empty root password and has no persistence.
Nozomi Networks Labs documented Kairos, a previously undocumented Go-based Linux DDoS bot that holds open thousands of idle TCP sessions to exhaust a victim’s connections. Honeypots saw three builds that differ by hard-coded command server and Go compiler patch level. Attackers logged in over Telnet as root with an empty password, then downloaded an architecture-matched payload. The bot accepts only flood, pause, and resume commands and does not persist or spread itself.
- A 16-core host opens 2,048 connections, using 128 workers per core.
- Each worker sends one space every five seconds after a real TCP handshake.
- One sample used 172.86.85.39 for payload on TCP/8080 and C2 on TCP/9999.
- The bot rewrites its process name to [kworker/0:1] but leaves other names intact.
- VirusTotal YARA matches found six more ARM, MIPS, and 32-bit x86 samples.
Impact: Exhausts servers with many idle TCP connections
| Product | Affected |
|---|---|
| Linux | — |
- 1.Block egress to the listed attacker addresses on ports 9999 and 8080.
- 2.Disable Telnet and replace default or empty passwords.
- 3.Alert on the plaintext REGISTER linux beacon and deploy the YARA rule.
- ATT&CK
- T1078 Valid AccountsT1105 Ingress Tool TransferT1499 Endpoint Denial of ServiceT1036.005 Match Legitimate Name
- Products
- Linux
- Malware
- Kairos
- Organizations
- Nozomi Networks Labs
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.124.165.53 | [.]41 on ports 9999 and 8080, and blocking the attacker IPs 103[.]124[.]165[.]53, 45[.]129[.]56[.]140 and 45[.]129[.]56[.]222. Securit |
| ipv4 | 172.86.85.39 | and background execution on each copy. In the sample chain, 172[.]86[.]85[.]39 hosted the payload on TCP/8080 and acted as C2 on TCP |
| ipv4 | 45.129.56.140 | d 8080, and blocking the attacker IPs 103[.]124[.]165[.]53, 45[.]129[.]56[.]140 and 45[.]129[.]56[.]222. Security teams should add an |
| ipv4 | 85.11.167.41 | locking egress to 91[.]92[.]42[.]84, 172[.]86[.]85[.]39 and 85[.]11[.]167[.]41 on ports 9999 and 8080, and blocking the attacker IPs |
| ipv4 | 91.92.42.84 | 9. Defenders can protect environments by blocking egress to 91[.]92[.]42[.]84, 172[.]86[.]85[.]39 and 85[.]11[.]167[.]41 on ports 9 |
From the original article
2 min read at gbhackers.com
Nozomi Networks Labs has documented Kairos, a previously undocumented Go-based DDoS bot for Linux. It turns compromised Linux devices into attack nodes that exhaust a victim’s connection capacity with thousands of idle TCP sessions. Kairos DDoS botnet Honeypot telemetry captured three Kairos builds.
By Kavichselvan · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.