FHN 
A newly identified IoT malware family called KATARU is targeting poorly secured Linux-based devices and turning them into potential DDoS attack nodes.
Researchers discovered the malware after an attacker repeatedly tried to guess Telnet credentials on a honeypot. After gaining access, the attacker downloaded an ARM-based payload.
KATARU has similarities to the Mirai botnet family, but it goes beyond basic DDoS functionality. It can attempt to gain root privileges, maintain access after reboots, communicate with its operators through encrypted channels, and execute remote commands.
The malware was identified by Nozomi Networks in August 2026 and was named KATARU based on a ChaCha20 nonce found in its configuration.
How KATARU Infects and Controls Devices
The attack starts with Telnet brute-force activity. Once valid credentials are found, BusyBox commands are used to download and launch the malware.
KATARU then checks the system and attempts several techniques to obtain higher privileges. Its code includes exploits for:
- CVE-2026-46300
- CVE-2026-43284
- CVE-2026-31431
- A cgroup v1
release_agentescape technique
Researchers found that the analyzed ARM sample contained shellcode designed for x86 systems. This may indicate that some components were reused from publicly available code without being fully adapted. Even with this limitation, the malware contains enough functionality to pose a risk to vulnerable devices.
KATARU also attempts to remain active after a reboot by using mechanisms such as systemd services, cron jobs, startup scripts, OpenWrt hooks, and Android boot locations. In some cases, it can also make its files harder to modify or remove.
The malware’s command-and-control traffic is encrypted using X25519 and ChaCha20-Poly1305, making simple network inspection more difficult.
KATARU can also perform several actions after infection, including:
- Launching TCP, UDP, ICMP, HTTP, QUIC, and DNS floods
- Running commands supplied by attackers
- Downloading additional files
- Attempting SSH brute-force activity
- Stopping ongoing DDoS attacks
- Removing its own files
Why IoT Security Teams Should Pay Attention
The biggest concern is how easily exposed IoT devices can become part of an attack infrastructure.
Devices with Telnet enabled, weak passwords, outdated firmware, or direct internet exposure provide attackers with an easy starting point. After compromise, the device can be used for DDoS attacks, additional malware deployment, or maintaining a foothold inside the environment.
KATARU’s DDoS functionality supports several protocols and includes attack options aimed at services such as Minecraft, FiveM, OpenVPN, and WireGuard.
For organizations, basic security controls can significantly reduce the risk:
- Disable Telnet and other unnecessary remote-access services
- Replace default and weak passwords
- Keep firmware and operating systems patched
- Isolate IoT and operational technology networks
- Restrict management access to trusted sources
- Monitor unusual outbound traffic and encrypted connections
- Watch for unexpected startup-file or system changes
- Investigate unusual SSH and Telnet activity
Unsupported devices that no longer receive security updates should be isolated behind tightly controlled access or replaced where possible.
Final Thoughts
KATARU shows that attackers continue to take advantage of familiar weaknesses in IoT environments. The combination of weak credentials, exposed services, outdated software, privilege-escalation techniques, and DDoS capabilities can quickly turn one vulnerable device into part of a larger attack operation.
For security teams, strong device hardening, timely patching, network segmentation, and continuous monitoring remain key defenses against emerging IoT botnets.
IoCs
| Type | Indicator | Description |
|---|---|---|
| File name | vlxx.arm | ARM payload retrieved and executed after Telnet credential brute forcing |
| SHA-256 | cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218 | Loader or closely related loader variant |
| SHA-256 | 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 | KATARU ARM32 payload |
| SHA-256 | 6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f | KATARU ARM32 sample |
| SHA-256 | 9d87e6615c810907443ebd5e915f3b35099c3b5c6b6c684637138a7f8ec9cebc | KATARU ARM32 sample |
| SHA-256 | 9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5 | KATARU AMD64 sample |
| IP address | 160[.]191.242.92 | Observed Telnet credential-brute-force source and C2 infrastructure |
About the Author
