New Kairos Botnet Leverages Open Telnet for DDoS Attacks on Linux Devices
A new Distributed Denial of Service (DDoS) botnet, dubbed Kairos, is actively infecting Linux devices by exploiting unsecured Telnet services that allow root login without a password.
A previously undocumented Distributed Denial of Service (DDoS) botnet named Kairos is targeting Linux devices by exploiting a fundamental security weakness: Telnet services configured to allow root login with an empty password. This campaign highlights how basic security oversights continue to provide attackers with easy entry points into systems. Unlike sophisticated threats, Kairos does not rely on complex exploits or zero-day vulnerabilities. Instead, attackers scan for exposed Telnet services, log in using the default root credentials, and proceed to install a compact Go-based program that transforms the compromised device into a node for launching DDoS attacks.
Security researchers at Nozomi Networks first identified the malware after their honeypots detected three distinct IP addresses distributing Kairos samples. The analysis revealed that the three samples were identical programs, differing only in their hard-coded command-and-control (C2) server addresses and minor variations in the Go compiler version used. This suggests the operator recompiles a single codebase to target different C2 infrastructure.
Once an attacker gains access via the unsecured Telnet service, a series of simple shell commands are executed. The process begins by checking the device's processor architecture using uname -m. Subsequently, the malware payload, specifically compiled for the detected architecture (e.g., x86_64), is downloaded. The dropper mechanism employs a multi-pronged approach, attempting to download the payload using various tools including wget, curl, BusyBox wget, and as a fallback, TFTP. This ensures a higher chance of success even on resource-constrained embedded systems that might lack common utilities.
After a successful download, the malware is granted execute permissions (chmod 777) and is launched in the background. The bot then establishes a connection to its hard-coded C2 server, identified by Nozomi Networks to be at 172[.]86[.]85[.]39 on TCP port 9999, and sends a plain-text registration beacon: REGISTER linux amd64 <NumCPU>. To maintain the connection, it sends a blank line every two seconds, with a retry mechanism in place if the connection drops, attempting to reconnect every five seconds indefinitely.
The Kairos botnet's attack methodology differs from typical high-volume DDoS attacks. Instead of overwhelming targets with massive bandwidth, Kairos opens hundreds or even thousands of legitimate TCP connections to the victim and sustains them. Each compromised device initiates a significant number of workers per CPU core, leading to a substantial number of concurrent connections. These connections complete the initial handshake, and then a single space character is sent periodically to keep the socket alive. In cases where the target actively refuses connections, the bot rapidly retries, creating a "connect storm" that can exhaust the victim's resources and prevent legitimate user access.
Despite its effectiveness, Kairos is relatively simple and lacks advanced features. It does not possess persistence mechanisms, self-spreading capabilities, or anti-analysis defenses. While it attempts to blend in by renaming itself to mimic Linux kernel threads like [kworker/0:1], its true process name is still discoverable using standard Linux tools. Furthermore, because the bot establishes real TCP connections, its source IP address is visible to the victim.
To defend against Kairos, organizations should prioritize disabling Telnet services, enforcing strong password policies, and replacing default credentials. Network defenses should include blocking outbound traffic to known Kairos C2 addresses on ports 9999 and 8080. Given that C2 addresses can change with each malware recompile, Nozomi Networks recommends implementing code-based detection methods. This includes deploying an Intrusion Detection System (IDS) rule for the distinctive REGISTER linux beacon and utilizing the provided YARA rule for identifying malicious binaries. Additionally, alerts should be configured for any "kernel worker" processes exhibiting a high number of outbound connections.
The campaign serves as a stark reminder that even basic security hygiene, such as securing remote access protocols and disabling unnecessary services, remains critical in preventing widespread compromise and participation in botnets. The exploitation of easily guessable credentials on legacy protocols like Telnet continues to be a significant threat vector for various malware families.