Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet

A new botnet called Kairos is spreading to Linux devices through a very old mistake: a Telnet service that accepts the root user with no password.

Once inside, the attackers install a small Go-based program that turns the device into a node for DDoS operations. The campaign shows that basic security gaps still give attackers an easy path in.

Kairos does not use a complex exploit or a zero-day flaw. The attackers connect to exposed Telnet services and log in as root with an empty password.

Weak remote access has fueled many botnets before, including a VOIP-based botnet attacking routers that also relied on default Telnet logins.

Analysts at Nozomi Networks identified the malware after their honeypots recorded three different IP addresses delivering Kairos samples.

The Nozomi Networks Labs report describes it as a previously undocumented DDoS bot for Linux. The three samples were the same program.

They differed only in the hard-coded command-and-control (C2) address and the Go compiler patch level, versions 1.27.0 and 1.27.1. This suggests the operator recompiles one codebase for each C2 server.

Hackers Exploit Passwordless Telnet

Every observed infection began the same way. The attacker guessed the default Telnet login, user root with an empty password. The operator then ran a short set of shell commands.

First, uname -m checked the device’s processor type, and the payload requested later, x86_64, matched it. This hints that the operator keeps a separate build for each architecture.

Next, the commands moved into the /tmp folder, removed leftovers from earlier attempts, and downloaded the malware.

The dropper tries several download methods in turn: wget, curl, BusyBox wget, and finally TFTP. Each downloaded copy gets full permissions with chmod 777 and runs in the background.

The BusyBox and TFTP fallbacks keep the loader working on small embedded systems that lack common tools. In the sample chain, the server at 172[.]86[.]85[.]39 hosted the payload on TCP port 8080 and also served as the C2 on port 9999.

Once running, the bot connects to its single hard-coded IP address and sends a plain-text beacon, REGISTER linux amd64 <NumCPU>. It then sends a blank line every two seconds to keep the session alive.

If the link drops, it tries again every five seconds with no limit. The C2 can send only three commands: hold, which starts a flood, !ka, which stops all attacks and pauses the bot, and !ku, which lets it accept attacks again. Similar Telnet-driven threats include the Tengu Mirai botnet that reboots IoT devices when someone tries to remove it.

How Kairos Floods Targets and How to Defend Against It

Kairos does not send huge amounts of traffic. Instead, it opens hundreds or thousands of real TCP connections to a victim and keeps them open. The bot starts 128 workers per CPU core, with a minimum of 256, so a 16-core device opens 2,048 connections per attack.

Each worker finishes a normal handshake, then sends one space character every five seconds to hold the socket open. If the target refuses the connection, the worker retries every 100 milliseconds, which creates a fast “connect storm.”

The victim’s service slowly runs out of room and stops accepting real users. The bot is simple and has weaknesses. It has no persistence, no self-spreading, no command execution, and no anti-analysis features.

It tries to hide by renaming itself [kworker/0:1] to look like a Linux kernel thread. However, tools like ps and the /proc folder still show the real name.

Since the bot completes real handshakes, its source IP is also visible to the victim. This is unlike KATARU IoT malware strain, which adds privilege escalation and encrypted C2 traffic.

Defenders should disable Telnet, replace default or empty passwords, and block outbound traffic to the known C2 addresses on ports 9999 and 8080.

Since the C2 address changes with each build, Nozomi advises relying on code-based detection. Teams can add an IDS rule for the plain-text REGISTER linux beacon and deploy the published YARA rule.

They should also alert on any “kernel worker” process holding many outbound connections. Exposed services remain a common entry point, as seen when a cPanel authentication bypass flaw was used to drop Mirai malware.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet appeared first on Cyber Security News.