Tsunami

Tsunami, also known in some contexts as Kaiten or TsunamiKit, is a long-running Linux malware family best known as an IRC-controlled botnet and backdoor used primarily for distributed denial-of-service attacks. It has been observed as an ELF payload on Linux systems, including servers, embedded devices, and IoT-class targets, and has appeared both as a standalone bot and as a secondary payload dropped after exploitation of exposed services or remote code execution vulnerabilities.

The malware’s core behavior centers on joining attacker-controlled IRC infrastructure to receive commands for remote control and attack execution. High-confidence reporting consistently associates Tsunami with DDoS functionality and backdoor capabilities, making it useful both for botnet operations and for maintaining post-compromise access. It has also been deployed alongside cryptocurrency miners in opportunistic Linux intrusion campaigns, especially in cloud and container-focused operations.

Tsunami has been linked to multiple threat ecosystems rather than a single operator. It has appeared in TeamTNT-associated cloud attacks, in Linux botnet activity observed through SSH honeypots, in exploitation waves following major internet-facing vulnerabilities such as Shellshock and Log4Shell, and as a payload installed by malware loaders and spreaders used by cryptomining groups. Variants and derivative families have also been documented: Muhstik has been described as a Tsunami variant incorporating Mirai code, and Remaiten was reported to combine features from Tsunami and LizardStresser/Torlus.

Operationally, Tsunami is most strongly characterized as a Linux bot/backdoor with IRC-based command and control, DDoS attack support, and general remote command execution capability. It is commonly used after initial compromise rather than as a self-contained initial access mechanism, although it may be delivered through exploitation chains, brute-force-driven Linux botnet activity, or follow-on payload deployment in broader campaigns.