Skip to content

Kaiten

Kaiten is a classic IRC-based DDoS bot, also known in some contexts as Tsunami.

Profile source: Mallory opens in a new tab

Kaiten

Family profile

Kaiten is a classic IRC-based DDoS bot, also known in some contexts as Tsunami. In the provided content it is referenced as an established botnet malware family and as a competitor process name targeted for termination by other Linux/IoT malware. Specifically, a Bash-based Linux worm targeting Raspberry Pi devices over SSH is described as killing running processes named "kaiten" alongside miners, zmap, and Mirai-related binaries in order to monopolize infected devices. The content also explicitly labels Kaiten as a "Classic IRC bot (Kaiten/Tsunami DDoS tool)." No additional high-confidence details on Kaiten’s own infection vector, infrastructure, or indicators of compromise are provided in the source content.

Observed infrastructure

Last seven days

First activity
Aug 7, 2026
Last activity
Aug 7, 2026
Feed role
Distribution
Host form
1 IP / 0 hostnames

Leading locations

  • US1

Leading providers

  • Unified Layer1

Infrastructure traits

  • Hosting 1

Samples

Recent associated samples

MITRE ATT&CK

Kaiten in ATT&CK

6 distinct techniques

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.