Kairos botnet infects Linux hosts through passwordless Telnet
Original title: Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet
Nozomi honeypots saw the same Go binary, which holds thousands of TCP sockets open during each attack.
Nozomi Networks Labs says a previously undocumented Linux DDoS bot, Kairos, logs in over Telnet as root with an empty password. Droppers try wget, curl, BusyBox wget, and TFTP, then the bot beacons in plaintext to one hard-coded command server. It has no persistence or self-spreading; Nozomi advises disabling Telnet and detecting the REGISTER linux beacon.
Unconfirmed: Nozomi calls Kairos previously undocumented; the operator is not identified.
- Samples differed only by C2 address and Go 1.27.0 or 1.27.1.
- A 16-core device opens 2,048 connections, with 128 workers per core.
- The only C2 commands described are hold, !ka, and !ku.
- The bot renames itself [kworker/0:1], but ps still shows the real name.
- Nozomi published attacker and C2 IPs, hashes, and a YARA rule.
Impact: Devices become DDoS nodes that exhaust services with open TCP connections
| Product | Affected |
|---|---|
| Linux | — |
- 1.Disable Telnet and replace empty or default passwords.
- 2.Block outbound traffic to known C2 addresses on ports 9999 and 8080.
- 3.Alert on the plaintext REGISTER linux beacon and many outbound connections from a fake kernel worker.
- ATT&CK
- T1078.001 Default AccountsT1105 Ingress Tool TransferT1499.002 Service Exhaustion FloodT1036.004 Masquerade Task or Service
- Products
- Linux
- Malware
- Kairos
- Organizations
- Nozomi Networks
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 103.124.165.53 | Indicators of compromise (IoCs):- Type Indicator Note IPv4 103[.]124[.]165[.]53 Attacker IP IPv4 172[.]86[.]85[.]39 Payload host (TCP |
| ipv4 | 172.86.85.39 | that lack common tools. In the sample chain, the server at 172[.]86[.]85[.]39 hosted the payload on TCP port 8080 and also served a |
| ipv4 | 45.129.56.140 | 86[.]85[.]39 Payload host (TCP/8080) and C2 (TCP/9999) IPv4 45[.]129[.]56[.]140 Attacker IP IPv4 91[.]92[.]42[.]84 C2 / payload serve |
| ipv4 | 45.129.56.222 | Attacker IP IPv4 91[.]92[.]42[.]84 C2 / payload server IPv4 45[.]129[.]56[.]222 Attacker IP IPv4 85[.]11[.]167[.]41 C2 / payload serv |
| ipv4 | 85.11.167.41 | / payload server IPv4 45[.]129[.]56[.]222 Attacker IP IPv4 85[.]11[.]167[.]41 C2 / payload server SHA-256 bfdf77ee849bffff7d6812f34 |
| ipv4 | 91.92.42.84 | and C2 (TCP/9999) IPv4 45[.]129[.]56[.]140 Attacker IP IPv4 91[.]92[.]42[.]84 C2 / payload server IPv4 45[.]129[.]56[.]222 Attacker |
| sha256 | 01568930028bdcce6ecd7e923971cf41f145e045e59536aa264241bc9a8e9650 | 72b534d57788046281349aacd42846f3df5e0b22655e1 amd64 SHA-256 01568930028bdcce6ecd7e923971cf41f145e045e59536aa264241bc9a8e9650 arm SHA-256 7635821eced7092e916e86471567e26c20ee5bda4a7b96f |
| sha256 | 181d1adfcf2da42afaa8fc1ceb4493cf2322c18431f3512673f4693e11b9cabd | 812f343841f3278e6e75949ab3e25644f17c24be87213 amd64 SHA-256 181d1adfcf2da42afaa8fc1ceb4493cf2322c18431f3512673f4693e11b9cabd amd64 SHA-256 87a77b056a6cf33ab3f72b534d57788046281349aacd4 |
| sha256 | 1ef5835cb0dfe305de05d92874c8a05eada9c02fcd04d9548dd059b44405519a | 3906af1ac9d851936e6556f323216e10cc1e129fa369a0 mips SHA-256 1ef5835cb0dfe305de05d92874c8a05eada9c02fcd04d9548dd059b44405519a mipsle SHA-256 9b628b5453576f3324036deb346db9cdd07bd673ecba |
| sha256 | 5743ebfc697385909b3906af1ac9d851936e6556f323216e10cc1e129fa369a0 | faa719665e0435619f8cc2f1d5dd13dd08134e0bf2d7dd6 arm SHA-256 5743ebfc697385909b3906af1ac9d851936e6556f323216e10cc1e129fa369a0 mips SHA-256 1ef5835cb0dfe305de05d92874c8a05eada9c02fcd04d9 |
| sha256 | 7635821eced7092e916e86471567e26c20ee5bda4a7b96f6b3d21a921862a416 | ecd7e923971cf41f145e045e59536aa264241bc9a8e9650 arm SHA-256 7635821eced7092e916e86471567e26c20ee5bda4a7b96f6b3d21a921862a416 arm SHA-256 82d0f2258b2eeeeacfaa719665e0435619f8cc2f1d5dd13 |
| sha256 | 82d0f2258b2eeeeacfaa719665e0435619f8cc2f1d5dd13dd08134e0bf2d7dd6 | 16e86471567e26c20ee5bda4a7b96f6b3d21a921862a416 arm SHA-256 82d0f2258b2eeeeacfaa719665e0435619f8cc2f1d5dd13dd08134e0bf2d7dd6 arm SHA-256 5743ebfc697385909b3906af1ac9d851936e6556f323216 |
| sha256 | 87a77b056a6cf33ab3f72b534d57788046281349aacd42846f3df5e0b22655e1 | 8fc1ceb4493cf2322c18431f3512673f4693e11b9cabd amd64 SHA-256 87a77b056a6cf33ab3f72b534d57788046281349aacd42846f3df5e0b22655e1 amd64 SHA-256 01568930028bdcce6ecd7e923971cf41f145e045e5953 |
| sha256 | 9b628b5453576f3324036deb346db9cdd07bd673ecba4a464d072ba01a8b7a54 | d92874c8a05eada9c02fcd04d9548dd059b44405519a mipsle SHA-256 9b628b5453576f3324036deb346db9cdd07bd673ecba4a464d072ba01a8b7a54 386 Note: IP addresses and domains are intentionally defang |
| sha256 | bfdf77ee849bffff7d6812f343841f3278e6e75949ab3e25644f17c24be87213 | cker IP IPv4 85[.]11[.]167[.]41 C2 / payload server SHA-256 bfdf77ee849bffff7d6812f343841f3278e6e75949ab3e25644f17c24be87213 amd64 SHA-256 181d1adfcf2da42afaa8fc1ceb4493cf2322c18431f35 |
From the original article
4 min read at cybersecuritynews.com
A new botnet called Kairos is spreading to Linux devices through a very old mistake: a Telnet service that accepts the root user with no password. Once inside, the attackers install a small Go-based program that turns the device into a node for DDoS operations. The campaign shows that basic security gaps still give attackers […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.