TuxBot v3 Evolution — Modular IoT Botnet Framework with LLM-Assisted Development and Multiple RCE Vectors (CVE-2022-1388, CVE-2022-22965, CVE-2020-8515, CVE-2022-44877)

Publication date: July 15, 2026
Category: Threat Intelligence / AI Attacks (LLM/LocalAI)

Introduction

Security researchers have identified a previously undocumented modular internet-of-things (IoT) botnet framework named TuxBot v3 Evolution. This malware stands out not only for its multi-platform architecture and extensive distributed denial-of-service (DDoS) capabilities, but also as a concerning milestone in cybercrime: the threat actors leveraged Large Language Models (LLMs) to assist in writing and porting the malware source code. Forensic analysis exposed LLM chain-of-thought reasoning artifacts left verbatim within code comments, alongside logical flaws introduced by the AI that went unnoticed by the operators.

What is TuxBot v3 Evolution? (General Analysis)

TuxBot v3 Evolution is a modular botnet kit designed to infect IoT devices and exposed servers through credential brute-forcing and the exploitation of critical historical remote code execution (RCE) vulnerabilities across various network devices and applications.

The framework includes a C-based agent cross-compiled for 17 different hardware architectures, a Go-based Command and Control (C2) server featuring a DDoS-for-hire administration panel, a custom exploit virtual machine, and a Docker-based automated build system.

The associated RCE vulnerabilities integrated into the framework’s exploitation catalog include severe flaws:

  • CVE-2022-1388: iControl REST authentication bypass in F5 BIG-IP (CVSS 9.8 Critical, CWE-306). Confirmed in CISA KEV catalog.
  • CVE-2022-22965: Spring Framework RCE via data binding (Spring4Shell) (CVSS 9.8 Critical, CWE-94). Confirmed in CISA KEV catalog.
  • CVE-2022-44877: OS command execution via shell metacharacters in Control Web Panel (CWP) (CVSS 9.8 Critical, CWE-78). Confirmed in CISA KEV catalog.
  • CVE-2020-8515: Unauthenticated RCE in DrayTek Vigor routers (CVSS 9.8 Critical, CWE-78). Confirmed in CISA KEV catalog.

Compromising these components exposes critical infrastructure and corporate servers to botnet enlistment for extortion-driven operations and massive traffic flood attacks.

How Does It Work? (Technical Analysis)

The operation of TuxBot v3 Evolution follows a structured automated lifecycle from infection to persistence and command channel resilience:

  • Initial Infection and Scanning Flow: The agent concurrently executes dedicated scanners for Telnet (using 1,496 default credential pairs), SSH, HTTP, and ADB (Android Debug Bridge). Valid credentials and responsive targets are processed to download and execute binaries from external dropper servers.
  • Persistence and Stealth Mechanisms: The bot establishes persistence through fake systemd services (sd-pam.service), cron entries, shell profile injections (.bashrc, .profile), periodic binary relocations under legitimate daemon names, and an anti-VM module that evaluates timestamps, DMI records, and CPU counters to evade sandbox analysis.
  • C2 Communication Layer and Resilience: The primary channel employs an encrypted TCP protocol utilizing elliptic curve cryptography (X25519) and authenticated encryption (ChaCha20-Poly1305). Fall-back mechanisms include an SHA-512 Domain Generation Algorithm (DGA), Ed25519-signed P2P gossip protocols, and DNS TXT queries.

“Blind reliance by developers on LLM-generated code introduced critical cryptographic syntax errors and XOR key mismatches, proving that current AI assistants can accelerate malware development while simultaneously injecting structural vulnerabilities if rigorous human code review is neglected.”

Affected Systems / Environments

The framework conceptually affects any exposed device or server running vulnerable versions of the products targeted by its exploit engines, spanning heterogeneous hardware architectures:

  • DrayTek Vigor network devices (CVE-2020-8515).
  • Web applications utilizing Spring Framework in WAR deployments with JDK 9+ (CVE-2022-22965).
  • F5 BIG-IP application delivery controllers (CVE-2022-1388).
  • CentOS Web Panel / Control Web Panel administration interfaces (CVE-2022-44877).
  • Hardware architectures compatible with compiled binaries: x86_64, ARM, ARM64, MIPS, MIPSEL, MIPS64, PowerPC, RISC-V, s390x, SH, SPARC, and others.
CVE Category (CWE) Impact CVSS Vector (summary)
CVE-2022-1388 CWE-306 (Missing Authentication) Remote Code Execution / Auth Bypass 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-22965 CWE-94 (Improper Control of Generation of Code / Spring4Shell) Remote Code Execution 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2020-8515 CWE-78 (OS Command Injection) Remote Code Execution as root 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-44877 CWE-78 (OS Command Injection) Remote Code Execution 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Mitigation and Detection

Remediation

  • Firmware and Patch Updates: Immediately apply official manufacturer patches for CVE-2022-1388 (F5), CVE-2022-22965 (Spring), CVE-2020-8515 (DrayTek), and CVE-2022-44877 (CWP).
  • Credential Hardening: Disable internet-exposed Telnet access on IoT devices and enforce strong, unique passwords instead of factory default credentials.
  • Network Segmentation: Isolate IoT devices and network gateways into dedicated VLANs with strict outbound traffic filtering (egress filtering).

Detection

  • Network IoC Monitoring: Audit network traffic for connections targeting known infrastructure servers (e.g., 185.10.68.127 or 209.182.237.133) and anomalous SHA-512-based DGA queries.
  • Endpoint Pattern Detection: Inspect endpoints for the Infected By Akiru console banner, the execution of the systemd service sd-pam.service, or processes masked under legitimate daemon names (systemd-udevd, dbus-daemon).
yaml 
rule TuxBot_v3_Indicators {
    meta:
        description = "Detects artifacts and indicators of TuxBot v3 Evolution binaries"
        author = "Honeynet Academic Analyst"
        date = "2026-07-15"
    strings:
        $banner = "Infected By Akiru" ascii
        $service = "sd-pam.service" ascii
        $magic_c2 = { 01 DE AD BE }
    condition:
        any of them
}

Wrapping Up

TuxBot v3 Evolution represents a significant evolution in IoT botnet design by incorporating robust encrypted communication architectures and AI-assisted development methodologies. Although blind dependence on AI introduced logical and cryptographic flaws in the analyzed sample, the ease with which these errors can be corrected demonstrates that commercial AI-driven next-generation botnets pose a persistent and scalable threat to global connected infrastructure.

References