TuxBot v3 IoT Botnet Leverages LLM for Development, Exposing Flaws
A new iteration of the TuxBot IoT botnet framework, dubbed TuxBot v3 Evolution, has been discovered incorporating Large Language Model (LLM) assistance in its development, leading to both enhanced capabilities and notable bugs.
Security researchers at Unit 42 have detailed the emergence of TuxBot v3 Evolution, a modular internet-of-things (IoT) botnet framework that showcases the growing influence of AI in malware development. The analysis reveals that the malware authors utilized an LLM to aid in generating code, a process that, while accelerating development, resulted in the inclusion of an unremoved AI safety disclaimer and several functional errors within the compiled samples.
The TuxBot framework itself is a composite, drawing features from known botnets like AISURU and the Wuhan lineage, alongside elements ported from the open-source MHDDoS Python DDoS toolkit. The recovered source code, compiled binaries for 17 different architectures, and extensive DDoS performance testing reports paint a picture of a sophisticated and adaptable threat. The bot agent is written in C and is designed to cross-compile for a wide array of architectures, including ARM, MIPS, x86_64, and RISC-V, enabling broad device compatibility.
Infection vectors for TuxBot v3 Evolution primarily rely on brute-forcing Telnet access using a substantial list of 1,496 credential pairs. Beyond brute-force methods, the framework also includes exploit code targeting over 30 different IoT device families. Once compromised, infected devices display the console banner "Infected By Akiru." Communication with the command-and-control (C2) server is secured via an encrypted TCP channel, but the botnet employs multiple fallback mechanisms to maintain connectivity, including a SHA512 domain generation algorithm (DGA), peer-to-peer (P2P) gossip with Ed25519-signed commands, IRC, DNS TXT queries, and HTTP polling.
The C2 infrastructure is built using Go and features a DDoS-for-hire panel, a custom exploit virtual machine, and a Docker-based test environment. This modular design allows for flexibility and scalability in its operations. The framework's automated build system further streamlines the deployment and management of botnet components.
Despite the advancements, the LLM-assisted development has introduced significant flaws. Approximately 70% of the framework's analyzed components are functional, with core infection and DDoS execution working as intended. However, exploit systems and other features are broken due to bugs that can be traced back to the AI-generated code. The LLM's raw reasoning logs were found verbatim in source files, and the developer failed to properly vet cryptographic implementations generated by the AI. These issues suggest that while the current iteration has limitations, more polished and dangerous versions are likely to emerge.
The development timeline, pieced together from Git logs within the source code archive, indicates a development period starting as early as January 2025, with significant activity in August 2025 and January 2026. This timeline suggests a sustained effort to build and refine the botnet, with the LLM integration appearing to be a more recent addition to the development process.
The implications of LLM-assisted malware development are significant. While it can lower the barrier to entry and accelerate the creation of complex tools, it also introduces new avenues for error and potential discovery. The fact that Unit 42 researchers could fix some of the broken features with simple LLM prompts highlights the double-edged sword of AI in cybersecurity. Adversaries can leverage these tools for rapid development, while defenders must contend with the evolving capabilities and potential vulnerabilities introduced by AI-generated code.
Palo Alto Networks customers are protected by products such as Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, and Advanced Threat Prevention. The discovery of TuxBot v3 Evolution underscores the dynamic nature of IoT threats and the increasing sophistication of malware development, driven in part by the accessibility of advanced AI tools.
The new article provides further technical details on the TuxBot v3 Evolution framework, including its multi-component architecture, the specific brute-force and exploit methods used against IoT devices, and its fallback communication protocols. It also elaborates on the LLM's role, noting that raw chain-of-thought reasoning was found verbatim in comments, and highlights the botnet's lineage from previous frameworks like Mirai and Wuhan, placing its operator within the Keksec ecosystem.
The TuxBot v3 Evolution botnet framework has been further detailed, revealing its use of multiple access vectors including Telnet, SSH, and HTTP scanning, alongside a comprehensive list of 1,496 username and password combinations for initial compromise. The malware's modular design, C-based client, and Go-based command-and-control server support at least 17 processor architectures, enabling broad deployment across diverse IoT devices. Researchers also noted that the operator has linked TuxBot infrastructure to broader Keksec, Kaitori, and AISURU-related activity through shared hosting and certificate artifacts, suggesting potential reuse of infrastructure across different campaigns.