EN PT-BR
← Voltar ao feed
high

Kairos: new Go-based Linux DDoS botnet exhausts servers with thousands of idle TCP connections

1 fonte(s) · 1 atualização(ões) · publicado 30/10/2026 07:49 · coletado há 2 dias

Nozomi Networks Labs has documented Kairos, a previously undocumented Go-based DDoS bot targeting Linux devices. Infected hosts open thousands of legitimate but idle TCP sessions against a target to exhaust its connection capacity, rather than using spoofed SYN floods. Initial access in observed honeypot cases came via Telnet with the default root user and an empty password, followed by a shell loader from /tmp that retrieved architecture-matched payloads. Three builds were captured differing only in hard-coded C2 address and Go compiler version (1.27.0/1.27.1), suggesting a build-per-C2 distribution model. A YARA hunt on VirusTotal surfaced six additional samples for ARM, MIPS (BE/LE) and 32-bit x86, all using C2 172[.]86[.]85[.]39.

Detalhes técnicos

  • Loader chain tries wget, curl, BusyBox wget and TFTP, with chmod 777 and background execution; payload hosted on TCP/8080, C2 on TCP/9999.
  • Plaintext beacon REGISTER linux amd64 <NumCPU> over TCP/9999, keepalive newline every 2s, redial every 5s with no jitter or retry limit.
  • Three commands only: hold <host> <port> <seconds>, !ka (cancel/pause), !ku (resume).
  • Spawns 128 workers per CPU core (minimum 256); a 16-core host opens 2,048 concurrent connections. Each worker completes a real TCP handshake (5s timeout) and sends a single space 0x20 every 5s to hold the socket; failed connects retry every 100ms, producing a connect storm.
  • No persistence, self-propagation, command execution, download capability or anti-analysis. Intact .gopclntab exposes kairos/methods.HoldFlood and kairos/methods.holdConn.
  • Masquerades by rewriting os.Args[0] to [kworker/0:1], but does not alter original argv memory or call prctl(PR_SET_NAME), so /proc/<pid>/cmdline, comm and ps reveal the real binary.
  • Because the victim sees the real source IP, operators expose infected hosts; large attacks can exhaust the bot's own file descriptors. Kairos is minimal compared with Mirai derivatives such as Evooo1Bot.

Remediação

  • Block egress to 91[.]92[.]42[.]84, 172[.]86[.]85[.]39 and 85[.]11[.]167[.]41 on ports 9999 and 8080; block attacker IPs 103[.]124[.]165[.]53, 45[.]129[.]56[.]140, 45[.]129[.]56[.]222.
  • Add an IDS signature for the plaintext REGISTER linux beacon on TCP/9999.
  • Disable Telnet and replace default or empty credentials.
  • Deploy the YARA rule for file and memory scanning (ELF containing both [kworker/0:1] and build path kairos/bot); alert on "kernel worker" processes holding many outbound TCP connections. Code-based signatures outlive IP blocks given the build-per-C2 model.

Linha do tempo

  1. gbhackers.com ↗ · pub. 30/10/2026 07:49 · coletado 30/10 08:00 primeiro registro

    Kairos: new Go-based Linux DDoS botnet exhausts servers with thousands of idle TCP connections

    ler a análise desta fonte

    Nozomi Networks Labs has documented Kairos, a previously undocumented Go-based DDoS bot targeting Linux devices. Infected hosts open thousands of legitimate but idle TCP sessions against a target to exhaust its connection capacity, rather than using spoofed SYN floods. Initial access in observed honeypot cases came via Telnet with the default root user and an empty password, followed by a shell loader from /tmp that retrieved architecture-matched payloads. Three builds were captured differing only in hard-coded C2 address and Go compiler version (1.27.0/1.27.1), suggesting a build-per-C2 distribution model. A YARA hunt on VirusTotal surfaced six additional samples for ARM, MIPS (BE/LE) and 32-bit x86, all using C2 172[.]86[.]85[.]39.

    Technical Details

    • Loader chain tries wget, curl, BusyBox wget and TFTP, with chmod 777 and background execution; payload hosted on TCP/8080, C2 on TCP/9999.
    • Plaintext beacon REGISTER linux amd64 <NumCPU> over TCP/9999, keepalive newline every 2s, redial every 5s with no jitter or retry limit.
    • Three commands only: hold <host> <port> <seconds>, !ka (cancel/pause), !ku (resume).
    • Spawns 128 workers per CPU core (minimum 256); a 16-core host opens 2,048 concurrent connections. Each worker completes a real TCP handshake (5s timeout) and sends a single space 0x20 every 5s to hold the socket; failed connects retry every 100ms, producing a connect storm.
    • No persistence, self-propagation, command execution, download capability or anti-analysis. Intact .gopclntab exposes kairos/methods.HoldFlood and kairos/methods.holdConn.
    • Masquerades by rewriting os.Args[0] to [kworker/0:1], but does not alter original argv memory or call prctl(PR_SET_NAME), so /proc/<pid>/cmdline, comm and ps reveal the real binary.
    • Because the victim sees the real source IP, operators expose infected hosts; large attacks can exhaust the bot's own file descriptors. Kairos is minimal compared with Mirai derivatives such as Evooo1Bot.

    Remediation

    • Block egress to 91[.]92[.]42[.]84, 172[.]86[.]85[.]39 and 85[.]11[.]167[.]41 on ports 9999 and 8080; block attacker IPs 103[.]124[.]165[.]53, 45[.]129[.]56[.]140, 45[.]129[.]56[.]222.
    • Add an IDS signature for the plaintext REGISTER linux beacon on TCP/9999.
    • Disable Telnet and replace default or empty credentials.
    • Deploy the YARA rule for file and memory scanning (ELF containing both [kworker/0:1] and build path kairos/bot); alert on "kernel worker" processes holding many outbound TCP connections. Code-based signatures outlive IP blocks given the build-per-C2 model.