**TuxBot v3 Evolution: AI-Assisted IoT Botnet Framework Revealed**
**Introduction**
Cybersecurity researchers from Palo Alto Networks Unit 42 have revealed details of a previously undocumented Internet-of-Things (IoT) botnet framework named **TuxBot v3 Evolution**. This framework shows signs of being developed with the assistance of a large language model (LLM), although the results were not entirely successful. The discovery highlights the evolving tactics of cybercriminals as they attempt to leverage AI to automate and enhance their malware capabilities.
**Key Findings**
The researchers found that while the LLM was able to generate botnet code, it included a safety disclaimer that the developer failed to remove before distributing the malware. “Although the LLM clearly aided in constructing the botnet, several functions in the analyzed samples failed to work correctly,” the report stated. A manual code review would likely have resolved these errors, and it’s possible that more polished versions of the malware are already in the wild.
**Technical Details**
TuxBot v3 Evolution is a modular framework composed of several components:
– A **C-based bot agent** that cross-compiles for multiple architectures, including ARM, MIPS, MIPSEL, MIPS64, x86_64, PowerPC, and RISC-V.
– A **Go-based command-and-control (C2) server** featuring a DDoS-for-hire panel.
– A **custom exploit virtual machine**.
– **Docker-based test infrastructure** and an **automated build system**.
The bot agent is designed to brute-force Telnet access using 1,496 credential pairs and exploit vulnerabilities targeting more than 30 IoT device families. It communicates with the C2 server over an encrypted TCP channel and employs advanced techniques such as a SHA512 domain generation algorithm (DGA), peer-to-peer (P2P) gossip protocol with Ed25519-signed commands, Internet Relay Chat (IRC), DNS TXT queries, and HTTP polling as a fallback mechanism.
**Origins and Infrastructure**
The framework’s lineage traces back to three different botnets—Mirai, AISURU, and Wuhan—and it partially ports functions from the open-source MHDDoS Python DDoS toolkit. At least one sample was uploaded to VirusTotal in January 2026, indicating it has been in existence for over six months. Development likely began around two years prior.
The Go-based C2 server listens on three TCP ports:
– **Port 1999 (or 31337)** for encrypted command dispatch.
– **Port 2222** for an interactive SSH shell.
– **Port 9999** for programmatic JSON access.
Once activated, the botnet initializes by loading C2 addresses from multiple fallback channels, setting up anti-debugging and anti-VM protections, hiding its process name, installing persistence, and launching various sub-modules. These modules enable DDoS attacks, process termination, C2 channel establishment, scanning for vulnerabilities, SOCKS5 proxy operation, and even cryptocurrency mining placeholder activities.
**LLM Artifacts and Ecosystem**
Interestingly, multiple files contained raw LLM chain-of-thought reasoning left verbatim in comments. These comments reveal the LLM’s internal decision-making process, including self-interruptions and references to “the user.” The researchers noted that shared infrastructure with **Kaitori v3.9** and **AISURU** tooling places TuxBot operators within the **Keksec ecosystem**, a group known for running multiple IoT botnet variants in parallel.
**Conclusion**
TuxBot v3 Evolution represents a concerning evolution in IoT botnet development, showcasing early attempts to integrate AI into malware creation. While the framework is not yet fully functional, its modular design, multiple C2 channels, and use of AI-assisted coding signal a shift toward more sophisticated and automated cyber threats. As botnet developers continue to refine their tools, security researchers must remain vigilant in identifying and mitigating these emerging risks.
—
### FAQ
**Q1: What is TuxBot v3 Evolution?**
A: TuxBot v3 Evolution is an IoT botnet framework that shows signs of being developed with the assistance of a large language model (LLM). It includes multiple components such as a bot agent, C2 server, exploit virtual machine, and automated build systems.
**Q2: How was AI involved in its creation?**
A: The LLM assisted in generating botnet code, but the developer failed to remove a safety disclaimer included by the AI. Several functions in the resulting code do not work correctly, indicating incomplete integration of AI-generated content.
**Q3: What vulnerabilities does TuxBot exploit?**
A: The bot agent brute-forces Telnet access using 1,496 credential pairs and exploits vulnerabilities across more than 30 IoT device families.
**Q4: What communication methods does TuxBot use?**
A: TuxBot employs encrypted TCP channels, SHA512 DGA, P2P gossip protocol with Ed25519-signed commands, IRC, DNS TXT queries, and HTTP polling as a fallback mechanism.
**Q5: Which ecosystems is TuxBot associated with?**
A: TuxBot shares infrastructure with Kaitori v3.9 and AISURU tooling, placing it within the Keksec ecosystem, a group known for operating multiple IoT botnet variants.
**Conclusion**
TuxBot v3 Evolution highlights the growing intersection of AI and cybercrime, where large language models are being explored as tools for automating malware development. Despite its incomplete functionality, the framework demonstrates advanced design choices, including multiple C2 channels and modular attack capabilities. As botnets evolve, so must defensive strategies to counter these emerging threats.
