Threat Overview: The Palo Alto Networks Unit 42 team released a new threat report on 2026-07-16 detailing TuxBot v3 Evolution, a modular IoT botnet that leverages large‑language models (LLM) during development. The framework combines a C‑based agent capable of cross‑compiling to 17 architectures with a Go‑written command and control (C2) server offering a DDoS-for-hire panel.
Architecture: The bot agent targets embedded devices by brute‑forcing Telnet access using 1,496 credential pairs. In addition, functional scanners for SSH, HTTP, ADB and a busybox probe are embedded. The primary C2 channel runs over an encrypted TCP session (X25519 key exchange followed by ChaCha20‑Poly1305 encryption) on port 1999 or 31337 depending on the build.
C2 Channels: Four fallback channels remain operational—domain generation algorithm (DGA), peer‑to‑peer gossip, DNS TXT queries and HTTP polling. The IRC channel is broken due to a string table XOR key mismatch, while the HTTP channel fails because of mismatched dropper URLs. These channels allow the bot to reconnect when the primary C2 is blocked.
Exploit Capability: At this stage only two exploit categories are functional—a remote code execution (RCE) scanner and an Android Debug Bridge (ADB) scanner. Other exploit modules, such as a custom virtual machine or CVE‑based payloads, are dead code or broken due to LLM hallucinations and key mismatches.
Detection Indicators: Infected devices display the console banner “Infected By Akiru.” Persistent services include sd-pam.service and cron jobs. Network indicators feature SSH banners such as SSH-2.0-CNC-Control-Server from 209[.]182[.]237[.]133, encrypted C2 handshakes starting with 0xDEADBE01, and HTTP requests with User-Agent TuxBot to the dropper at 185[.]10[.]68[.]127.
LLM‑Assisted Development: The source code contains raw LLM chain‑of‑thought comments that reveal generation steps. Hallucinated Argon2id password hashing, XOR key mismatches and a faulty virtual machine magic number were identified. These errors would have been caught during a manual review but were missed because developers accepted the auto‑generated output.
Operational Status Summary: Core infection flow, credential brute force, SSH/HTTP/ADB scanners, DDoS engine, persistence mechanisms and encrypted primary C2 are fully functional. IRC, HTTP fallback channels and certain exploit modules are broken or dead code. Overall functionality is roughly 70% but can be elevated if the operator applies the identified fixes.
Mitigation Recommendations: Deploy Palo Alto Networks Advanced WildFire to automatically quarantine malware samples. Enable Advanced URL Filtering and DNS Security to block known domains such as c2.tuxbot.local and hxxps://unit42[.]paloaltonetworks[.]com/tuxbot-v3-evolution-iot-botnet/. Use Advanced Threat Prevention rules to detect anomalous outbound traffic to 209[.]182[.]237[.]133 or 185[.]10[.]68[.]127, and block SMTP or DNS TXT queries that match DGA patterns.
Incident Response: Isolate infected devices immediately. Remove persistence layers by disabling sd-pam.service, deleting cron entries, and purging hidden backup copies. Clear bot binaries from /tmp/.%08x.lock and any residual network sockets. Contact Unit 42 Incident Response with the provided toll‑free numbers for rapid assistance.
Ecosystem Context: The dropper IP 185[.]10[.]68[.]127 is shared with the Keksec/Kaitori family, indicating a broader DDoS-for-hire operation. Monitoring this infrastructure and its associated domains can provide early warning of future TuxBot variants.
Conclusion: Although currently incomplete, the TuxBot v3 framework demonstrates how LLM assistance can accelerate malware development while introducing reproducible bugs that attackers can patch quickly. Continuous monitoring of the identified indicators and application of Palo Alto security controls remain essential to mitigate this evolving threat.
