Malware family
Kaiten
Kaiten is a classic IRC-based DDoS bot, also known in some contexts as Tsunami.
Profile source: Mallory opens in a new tabKaiten
Family profile
Kaiten is a classic IRC-based DDoS bot, also known in some contexts as Tsunami. In the provided content it is referenced as an established botnet malware family and as a competitor process name targeted for termination by other Linux/IoT malware. Specifically, a Bash-based Linux worm targeting Raspberry Pi devices over SSH is described as killing running processes named "kaiten" alongside miners, zmap, and Mirai-related binaries in order to monopolize infected devices. The content also explicitly labels Kaiten as a "Classic IRC bot (Kaiten/Tsunami DDoS tool)." No additional high-confidence details on Kaiten’s own infection vector, infrastructure, or indicators of compromise are provided in the source content.
MITRE ATT&CK
Kaiten in ATT&CK
6 distinct techniquesReporting
Research mentioning Kaiten
Mar 14
Breakglass Intel
Linux.IRCBot/RaspiWorm - Raspberry Pi SSH Worm with IRC C2 - Breakglass Intelligence - Breakglass Intelligence
kaiten — Classic IRC bot (Kaiten/Tsunami DDoS tool)
Jun 19
Qianxin Xlab
New Threat: A Deep Dive Into the Zergeca Botnet
To monopolize the device, Zergeca includes a list of competitor threats, covering miners, backdoor trojans, botnets, and more. Some familiar names on the list include mozi, kinsing, and various mining pools.
