Kairos DDoS botnet spreads to Linux devices via passwordless Telnet root logins
MALWAREBusyBoxredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A new botnet called Kairos is infecting Linux devices that have Telnet switched on with the root account set to no password. Once inside, the device is turned into a tool that can be used to flood websites and services with traffic.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Disable Telnet on Linux devices and replace any default or empty root passwords.
- Block outbound traffic to the known C2 and payload addresses on TCP ports 9999 and 8080.
- Deploy the published YARA rule and an IDS rule for the plain-text REGISTER linux beacon.
- Alert on any process named like a kernel worker that holds many outbound connections.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Products