Kaiji is a Go-based Linux botnet malware family associated with distributed denial-of-service operations against servers, IoT devices, and other internet-exposed Linux systems. It was built as a custom implant rather than a straightforward reuse of Mirai- or BillGates-derived code, and has been assessed as having Chinese-language development artifacts. Kaiji has been observed targeting weakly secured SSH services, exposed Docker APIs, and vulnerable server environments reached through exploitation chains that deliver architecture-specific ELF payloads.
Kaiji’s core role is DDoS enablement. Reported attack support includes multiple TCP and UDP flooding modes as well as SYN, ACK, SYNACK, IP spoofing, and in some variants WebSocket-based attack functionality. Beyond DDoS, Kaiji can execute arbitrary shell commands, collect host and environment information, and in some campaigns has been used to deploy or support cryptomining activity. Some observed variants also provide proxy or relay functionality, broadening monetization beyond simple botnet participation.
Propagation has included SSH brute forcing, especially against the root account, and abuse of exposed Docker infrastructure by deploying malicious containers or scripts that fetch and run Kaiji binaries. Kaiji has also attempted lateral movement by reusing locally available SSH keys and host information recovered from shell history to access additional systems. In later intrusion reporting, Kaiji appeared as a post-exploitation payload delivered after exploitation of server-side vulnerabilities, including campaigns against cloud and containerized environments.
Persistence and defense evasion are prominent features. Kaiji has been observed installing itself under names resembling legitimate system utilities, copying itself to alternate locations, modifying startup mechanisms across systemd, SysV/init scripts, rc.d, cron, and profile scripts, and in some cases backdooring startup-related components. Variants have also altered SELinux policy, replaced or tampered with common administrative utilities, used process masquerading, and abused watchdog or reboot mechanisms to recover if terminated. Some reporting also describes process-hiding and command-output filtering behavior intended to obstruct incident response.
Kaiji primarily targets Linux platforms, including conventional servers, cloud-hosted workloads, containers, and IoT devices. It has repeatedly appeared in opportunistic mass-compromise activity and in multi-payload campaigns alongside miners and other Linux malware. Chaos has been widely assessed as an evolutionary descendant of Kaiji based on code overlap and inherited functionality.
