30
30
30
35
30
30
35
45
30
30
35
30
30
45
30
30
30
35
30
30
30
30
30
30
35
30
30
30
50
30
Tortoiseshell Expands Malware Toolset With New Backdoor, SSH Tunnel
Group-IB uncovered new infrastructure linked to the Tortoiseshell threat actor, including an additional backdoor and an SSH tunneling tool.
Group-IB researchers have discovered new Tortoiseshell infrastructure, revealing an expanded backdoor and a purpose-built SSH tunneling utility. Tortoiseshell is known for targeting IT providers and telecom companies, frequently through supply-chain attacks. The expanded toolset suggests the group is investing in stealthy persistence and covert network communications.
45
TuxBot v3: Inside an IoT Botnet Framework With LLM
Unit 42 uncovers TuxBot v3, an LLM-assisted IoT botnet framework with 17-architecture builds, Telnet brute-forcing, and DDoS capabilities.
Palo Alto Unit 42 identified TuxBot v3 Evolution, a modular IoT botnet framework derived from AISURU, Wuhan-lineage botnets, and MHDDoS. The C-based bot brute-forces Telnet with 1,496 credential pairs, targets over 30 IoT device families, and communicates with a Go-based C2 over encrypted TCP with multiple fallback mechanisms including DGA, P2P, and DNS TXT. LLM-assisted development left hallucinated crypto implementations and broken exploit modules in the analyzed samples, though roughly 70% of core functionality works. Researchers warn polished production builds likely exist, raising the threat potential.
45
45
30
35
45
30
30
45
35