Gafgyt

Creating EMBeD, the Embedded Malware Benchmark Dataset - Malware Analysis - Malware Analysis, News and Indicators

Researchers at CrySyS Lab presented EMBeD (Embedded Malware Benchmark Dataset), a proposed public benchmark intended to make IoT malware-binary detection research more reproducible and comparable. The dataset addresses reliance on proprietary collections, inconsistent malware-family labels, and undisclosed machine-learning training and test splits by providing balanced, consistently labeled samples. EMBeD extracts sample metadata, filters unreliable binaries, and derives and validates family labels using weighted VirusTotal detections and TLSH-based similarity graphs. Its proof of concept processed 67,800 MIPS IoT-malware samples and produced seven families—Mirai, Gafgyt, Hajime, Kaiji, Tsunami, DDoSTF, and Dofloo—with 100 samples per family; planned releases will expand coverage and add architectures including ARM using sources such as VirusTotal and Ukatemi's Kaibou Repo.

Creating EMBeD, the Embedded Malware Benchmark Dataset - CrySyS Blog

Threat news: TeamTNT stealing credentials using EC2 Instance Metadata | Sysdig

TeamTNT continued to evolve from a Linux-focused cryptojacking group into a broad cloud threat actor targeting exposed Redis, Docker, Kubernetes, Jupyter, Hadoop, PostgreSQL, Tomcat, Nginx, SSH, and other internet-facing services. Researchers tied the group to worm-like campaigns that rapidly scanned for vulnerable hosts, deployed XMRig miners, dropped Tsunami-based IRC bots including DDoS-capable variants, and used malicious container images on Docker Hub to spread payloads at scale. One TeamTNT-linked Docker Hub account reportedly served images pulled more than 150,000 times, while later campaigns showed the group abusing public registries, compromised accounts, and cloud-native tooling to infect newly exposed systems and report them back to command-and-control infrastructure. Across these operations, TeamTNT consistently paired monetization with aggressive credential theft and stealth. Investigations found the group harvesting AWS, Azure, GCP, Kubernetes, Git, NPM, Grafana, database, and storage secrets; stealing SSH keys and host data; and using tools such as Weave Scope, Peirates, BotB, MimiPenguin, Mimipy, tmate, and Gsocket to expand access and persistence. Analysts also documented detection evasion through log wiping, process hiding, LD_PRELOAD userland rootkits, the Diamorphine kernel rootkit, privileged containers with restart policies, and even disabling runc to lock out rival attackers, underscoring TeamTNT’s shift from opportunistic mining to sustained compromise of cloud and container environments.

Gafgyt Botnet Hijacks Langflow for DDoS Attacks

Attackers are actively exploiting CVE-2025-3248, a remote code execution flaw in Langflow’s code validation API, to compromise internet-exposed AI development servers and deploy a customized Gafgyt/BASHLITE malware variant on x86_64 Linux systems. Akamai reported that the intrusion chain uses untrusted Python execution to fetch a Linux binary from a staging server, launch it from a temporary directory, and turn the host into a bot focused on distributed denial-of-service activity rather than cryptomining, persistence, or lateral movement. The malware reportedly supports multiple flood modes, including UDP, TCP, HOLD, and junk/STD, and uses a modified RC4-based cipher to obscure command-and-control traffic and hinder standard decoding. CISA added CVE-2025-3248 to its Known Exploited Vulnerabilities catalog, while GreyNoise observed hundreds of exploit source IPs targeting the flaw. Defenders are being urged to patch Langflow, isolate AI development environments, place exposed instances behind a WAF, enforce outbound filtering including blocking unauthorized traffic such as port 1337, and deploy YARA detections keyed to the malware’s distinctive cipher seed bytes.

TuxBot v3 Evolution: LLM-Built IoT Botnet Exposed

Palo Alto Networks Unit 42 reported on TuxBot v3 Evolution, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across 17 CPU architectures. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and 254 DDoS benchmark reports, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with 1,496 credentials, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping. The report said the framework appears to have been developed with heavy LLM assistance, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake Argon2id routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at 209.182.237[.]133 and a dropper at 185.10.68[.]127, with reported ties to the Keksec/Kaitori and AISURU ecosystems.

New TuxBot v3 Evolution IoT botnet framework shows signs of AI development | brief | SC Media

TuxBot v3: The IoT Botnet Built With AI - Bugs, Disclaimers and All

New TuxBot v3 IoT Botnet Uses LLM-Generated Code to Hijack Devices and Launch DDoS Attacks