Nozomi documents Kairos Go botnet hijacking Linux via empty-root Telnet
First merged summary.
Nozomi says the new Kairos Go bot floods targets with idle TCP connections after passwordless Telnet logins and does not persist.
Nozomi Networks Labs documented Kairos, a previously undocumented Go-based Linux DDoS bot that holds thousands of idle TCP sessions open to exhaust a victim’s connections. Honeypots saw attackers log in over Telnet as root with an empty password, then download an architecture-matched payload using wget, curl, BusyBox wget, or TFTP. Three builds differed by hard-coded command server and Go 1.27.0 or 1.27.1. GBHackers says the bot accepts only flood, pause, and resume; Cyber Security News says the only commands described are hold, !ka, and !ku. The bot does not persist or spread itself. Nozomi advises disabling Telnet and detecting the plaintext REGISTER linux beacon.
- A 16-core host opens 2,048 connections, 128 workers per core.
- Each worker sends one space every five seconds after a TCP handshake.
- One sample used 172.86.85.39: payload TCP/8080, C2 TCP/9999.
- The process name is rewritten to [kworker/0:1]; other names remain visible.
- VirusTotal YARA matches found six more ARM, MIPS, and 32-bit x86 samples.
What each outlet adds
beyond the shared facts- GBHackersC2 IP and ports, keepalive timing, and six extra VirusTotal samples.
- Cyber Security NewsGo versions, dropper tools, REGISTER beacon, and hold/!ka/!ku commands.
- Products
- Linux
- Malware
- Kairos
- Organizations
- Nozomi Networks LabsNozomi Networks
Coverage
oldest first · one row per article · UTC- · 17h ago
GBHackersFirst report
Kairos DDoS botnet opens idle TCP sessions from Linux hosts
Nozomi says the Go bot arrives over Telnet with an empty root password and has no persistence.
- · 14h ago
Cyber Security News
Kairos botnet infects Linux hosts through passwordless Telnet
Nozomi honeypots saw the same Go binary, which holds thousands of TCP sockets open during each attack.