Nozomi Networks: New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

New IoT Malware KATARU Exploits Linux Vulnerabilities to Build DDoS Botnet

A recently discovered IoT malware family, KATARU, is targeting internet-exposed devices via Telnet brute-forcing, exploiting weak credentials to gain initial access. Once inside, the malware attempts to escalate privileges to root using publicly available Linux kernel exploits, including CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and CVE-2026-31431 (Copy Fail) all of which enable local privilege escalation in vulnerable Linux systems.

Key Features & Tactics

• Initial Access & Privilege Escalation: KATARU checks for writable /etc/passwd files to modify root credentials, allowing passwordless su access. If unsuccessful, it deploys multiple Linux kernel exploits, though some embedded exploit code contains x86 shellcode mismatched for ARM devices, suggesting untested or copied exploit material.
• Persistence Mechanisms: The malware employs an unusually broad persistence strategy, targeting:
  • Systemd services, timers, and generators
  • Cron jobs and @reboot entries
  • rc.local, SysV init, and shell profiles
  • OpenWrt, U-Boot, DHCP, udev, and package-manager hooks
  • Android boot scripts and init services
  • XDG autostart locations
    This "try everything" approach ensures survival across reboots on routers, embedded Linux devices, industrial appliances, and potentially rooted Android systems.
• Command & Control (C2): Unlike older Mirai variants, KATARU uses X25519 key exchange and ChaCha20-Poly1305 encryption for C2 communications, complicating traffic analysis. However, an implementation flaw reveals the use of RFC 7748 test keys, indicating reused reference code rather than secure key management.
• DDoS & Secondary Attacks: Infected devices can launch TCP, UDP, ICMP, HTTP, QUIC, and DNS floods, with specialized attacks targeting Minecraft, FiveM, OpenVPN, and WireGuard services. The malware also includes SSH brute-forcing capabilities and can download additional payloads or execute shell commands.
• Anti-Analysis & Decoy Traffic: KATARU employs anti-debugging checks (e.g., ptrace, LD_PRELOAD, Valgrind detection) and generates fake beacon traffic, synthetic HTTP requests, and junk UDP packets to mislead analysts.

Discovery & Attribution

The malware was first identified after a honeypot detected Telnet brute-force activity from a Vietnamese IP address (160[.]191.242.92). Analysis by Nozomi Networks revealed staging markers (condi72, condixx) linking KATARU to a loader derived from previously public dropper code. The primary payload, an ARM binary (vlxx.arm), was downloaded via BusyBox commands post-compromise.

Impact & Mitigation Considerations

KATARU demonstrates how commodity botnets rapidly integrate public exploits and copied code into disruptive threats, even with imperfect implementation. While its architecture mismatches (x86 shellcode in ARM binaries) may limit effectiveness, misconfigured or unpatched systems remain at risk. Defenders should prioritize:

• Disabling Telnet and eliminating default credentials.
• Segmenting IoT device management behind VPNs or dedicated networks.
• Monitoring for unauthorized systemd units, cron jobs, altered boot scripts, and immutable files.
• Patching Linux kernels to mitigate Fragnesia, Dirty Frag, and Copy Fail vulnerabilities.

Indicators of Compromise (IOCs)

• SHA-256 Hashes:
  • Loader: cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218
  • ARM32 Payloads:
    • 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4
    • 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f
    • 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc
  • AMD64: 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5
• C2 IP: 160[.]191.242.92 (Telnet brute-forcing & C2 activity)

  Source: https://gbhackers.com/iot-malware-attacks/

  Nozomi Networks cybersecurity rating report: https://www.rankiteo.com/company/nozomi-networks-sa

"id": "NOZ1789122518",
"linkid": "nozomi-networks-sa",
"type": "Vulnerability",
"date": "9/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"

{'affected_entities': [{'industry': 'Technology, Industrial, Consumer '
                                    'Electronics',
                        'type': 'IoT devices, Linux-based systems'}],
 'attack_vector': 'Telnet brute-forcing, Linux kernel exploits',
 'description': 'A recently discovered IoT malware family, KATARU, is '
                'targeting internet-exposed devices via Telnet brute-forcing, '
                'exploiting weak credentials to gain initial access. Once '
                'inside, the malware attempts to escalate privileges to root '
                'using publicly available Linux kernel exploits, including '
                'CVE-2026-46300 (Fragnesia), CVE-2026-43284 (Dirty Frag), and '
                'CVE-2026-31431 (Copy Fail). The malware employs broad '
                'persistence mechanisms, advanced C2 encryption, and DDoS '
                'capabilities targeting various services.',
 'impact': {'operational_impact': 'Potential DDoS disruptions, unauthorized '
                                  'access, system compromise',
            'systems_affected': 'Routers, embedded Linux devices, industrial '
                                'appliances, rooted Android systems'},
 'initial_access_broker': {'entry_point': 'Telnet brute-forcing'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Commodity botnets rapidly integrate public exploits and '
                    'copied code into disruptive threats, even with imperfect '
                    'implementation. Misconfigured or unpatched systems remain '
                    'at high risk.',
 'motivation': 'DDoS attacks, secondary payload deployment, potential '
               'financial gain',
 'post_incident_analysis': {'corrective_actions': ['Disabling Telnet',
                                                   'Patching vulnerabilities',
                                                   'Network segmentation',
                                                   'Enhanced monitoring'],
                            'root_causes': 'Weak credentials, unpatched Linux '
                                           'vulnerabilities, exposed Telnet '
                                           'services'},
 'recommendations': ['Disable Telnet and eliminate default credentials',
                     'Segment IoT device management behind VPNs or dedicated '
                     'networks',
                     'Monitor for unauthorized systemd units, cron jobs, '
                     'altered boot scripts, and immutable files',
                     'Patch Linux kernels to mitigate Fragnesia, Dirty Frag, '
                     'and Copy Fail vulnerabilities'],
 'references': [{'source': 'Nozomi Networks'}],
 'response': {'enhanced_monitoring': 'Recommended for unauthorized systemd '
                                     'units, cron jobs, altered boot scripts',
              'network_segmentation': 'Recommended',
              'remediation_measures': ['Disabling Telnet',
                                       'Eliminating default credentials',
                                       'Segmenting IoT device management',
                                       'Patching Linux kernels'],
              'third_party_assistance': 'Nozomi Networks'},
 'title': 'New IoT Malware KATARU Exploits Linux Vulnerabilities to Build DDoS '
          'Botnet',
 'type': 'Malware (Botnet)',
 'vulnerability_exploited': ['CVE-2026-46300 (Fragnesia)',
                             'CVE-2026-43284 (Dirty Frag)',
                             'CVE-2026-31431 (Copy Fail)']}