Kairos DDoS botnet spreads to Linux devices via passwordless Telnet root logins
MALWAREredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
Nozomi Networks reports a previously undocumented Go-based DDoS bot, Kairos, spreading via exposed Telnet services that accept root with an empty password. The bot opens large numbers of real TCP connections to victims and holds them open, and it has no persistence or self-spreading, but it is simple to deploy at scale on exposed devices.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Disable Telnet on Linux devices and replace any default or empty root passwords.
- Block outbound traffic to the known C2 and payload addresses on TCP ports 9999 and 8080.
- Deploy the published YARA rule and an IDS rule for the plain-text REGISTER linux beacon.
- Alert on any process named like a kernel worker that holds many outbound connections.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News