TuxBot v3 Evolution IoT botnet framework uses LLM-generated code for DDoS attacks
Cybersecurity researchers discovered TuxBot v3 Evolution, a previously undocumented modular IoT botnet framework that leveraged a large language model to assist in code development. The malware, which infects devices to conduct DDoS attacks, contains LLM-generated code with included safety disclaimers that developers failed to remove, and exhibits several non-functional features due to lack of manual code review.
What happened
Palo Alto Networks Unit 42 identified TuxBot v3 Evolution, a previously undocumented modular IoT botnet framework in which malware authors leveraged an LLM to assist in code development.
The LLM generated botnet code but included a safety disclaimer that the developer failed to remove before deployment. Several functions in the analyzed samples failed to work correctly due to lack of manual code review.
The botnet framework consists of a C-based bot agent cross-compiled for multiple architectures, a Go-based command-and-control server with a DDoS-for-hire panel, exploit code targeting more than 30 IoT device families, and multiple C2 fallback mechanisms including a domain generation algorithm, peer-to-peer gossip, IRC, DNS queries, and HTTP polling.
Reported impact
The bot agent brute-forces Telnet access on targeted devices using 1,496 credential pairs and infects devices to display the console banner 'Infected By Akiru.' The framework enables distributed denial of service attacks through an automated DDoS-for-hire panel.
Index analysis
The LLM's inclusion of a safety disclaimer in the generated code demonstrates that the model flagged potential misuse concerns, yet the developer proceeded with deployment despite this warning. While the AI successfully generated functional botnet code, multiple functions failed to operate correctly, suggesting the authors relied entirely on LLM output without verifying code quality.
Governance controls
Palo Alto Networks reported the threat through its Timely Threat Intelligence program and recommends that customers use Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, and Advanced Threat Prevention to defend against the threats posed by TuxBot v3 Evolution.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.