Kairos DDoS botnet spreads to Linux devices via passwordless Telnet root logins
- Severity
- High
- Sources
- 1
What happened
Nozomi Networks documented Kairos, a previously undocumented Go-based Linux DDoS bot delivered via Telnet logins as root with an empty password. Samples (Go 1.27.0 and 1.27.1 builds) differ only in hard-coded C2 and compiler patch level, and the dropper falls back from wget and curl to BusyBox wget and TFTP. The bot beacons with REGISTER linux amd64, accepts hold, !ka and !ku commands, and floods via full TCP handshakes with connection storms. Defenders should disable Telnet, remove default or empty passwords, block outbound traffic to the C2 on TCP 9999 and the payload host on TCP 8080, deploy the published YARA rule and an IDS rule for the beacon, and alert on kernel-worker-named processes with many outbound connections.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Disable Telnet on Linux devices and replace any default or empty root passwords.
- Block outbound traffic to the known C2 and payload addresses on TCP ports 9999 and 8080.
- Deploy the published YARA rule and an IDS rule for the plain-text REGISTER linux beacon.
- Alert on any process named like a kernel worker that holds many outbound connections.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Products