TuxBot v3 Evolution Framework — Technical Analysis of an AI-Assisted IoT Threat and Multiple RCE Vectors (CVE-2022-1388, CVE-2022-22965, CVE-2020-8515, CVE-2022-44877)

Publication date: July 15, 2026
Category: AI attacks (LLM/LocalAI) / Threat Intelligence

Introduction

Security researchers have identified a previously undocumented modular Internet of Things (IoT) botnet framework dubbed TuxBot v3 Evolution. Discovered through internal telemetry analysis and wild sample recovery, this malware stands out for having been partially developed using a Large Language Model (LLM), which inadvertently left behind raw chain-of-thought reasoning and safety disclaimers within the source code. The framework incorporates a C-based agent cross-compiling for 17 hardware architectures, a Go-based Command and Control (C2) server featuring a DDoS-for-hire panel, a custom exploit virtual machine, and a Docker-based automated deployment infrastructure. Despite advanced resilience mechanisms including Domain Generation Algorithms (DGA) and P2P gossip communication, forensic analysis reveals that coding flaws introduced by the AI—such as XOR key mismatches and virtual machine magic byte incompatibilities—currently disable several attack and exploitation routines in the initial sample sets.

What is TuxBot v3 Evolution? (General Analysis)

TuxBot v3 Evolution is a modular botnet ecosystem engineered to massively compromise network devices and edge servers. The threat combines codebase snippets inherited from known botnet families such as AISURU, undocumented lineages originating from Wuhan, and adaptations derived from the MHDDoS Python DDoS toolkit.

Operating under a dual-versioning scheme (3.5.2 for the installer and 3.0.0-EVOLUTION-FINAL inside container configurations), the framework integrates autonomous propagation routines via Telnet brute-forcing using 1,496 default credentials, alongside dedicated scanners for SSH, HTTP, and ADB. Its attack vectors contemplate critical Remote Code Execution (RCE) vulnerabilities that leverage historical flaws in enterprise gateways and control panels.

Official NVD-verified data for the core CVEs integrated into the framework specifications include:

• CVE-2022-1388 (F5 BIG-IP iControl REST Authentication Bypass): Allows unauthenticated attackers to bypass iControl REST authentication and execute arbitrary commands.

  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL) [CONFIRMED FACT - NVD]
  • Official CWE: CWE-306 [CONFIRMED FACT - NVD]
  • CISA KEV Catalog: Yes [CONFIRMED FACT - NVD]

• CVE-2022-22965 (Spring4Shell): Remote code execution vulnerability in Spring MVC or Spring WebFlux applications running on JDK 9+ and Tomcat via data binding.

  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL) [CONFIRMED FACT - NVD]
  • Official CWE: CWE-94 [CONFIRMED FACT - NVD]
  • CISA KEV Catalog: Yes [CONFIRMED FACT - NVD]

• CVE-2020-8515 (DrayTek Vigor RCE): Remote command execution as root via shell metacharacters sent to the cgi-bin/mainfunction.cgi URI without authentication.

  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL) [CONFIRMED FACT - NVD]
  • Official CWE: CWE-78 [CONFIRMED FACT - NVD]
  • CISA KEV Catalog: Yes [CONFIRMED FACT - NVD]

• CVE-2022-44877 (Control Web Panel 7 RCE): Remote execution of arbitrary OS commands via shell metacharacters in the login parameter of login/index.php.

  • Official CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8 (CRITICAL) [CONFIRMED FACT - NVD]
  • Official CWE: CWE-78 [CONFIRMED FACT - NVD]
  • CISA KEV Catalog: Yes [CONFIRMED FACT - NVD]

How Does It Work? (Technical Analysis)

The operation of TuxBot v3 Evolution spans from initial infection and host persistence to complex evasion layers and resilient communication with its command and control infrastructure.

Initial Infection Flow and Scanning

Written in C and statically linked against glibc and libsodium, the bot agent executes a fixed initialization sequence upon startup:

1. Initialization and Stealth: Seeds the pseudo-random number generator, sets up anti-debugging protections, hides its process name, and adopts false identities mimicking system daemons (e.g., systemd-udevd, dbus-daemon, cron, sshd) through periodic binary relocation across 21 dot-prefixed directories.
2. Autonomous Propagation: Launches mass scanning threads leveraging:
   • A Telnet brute-force scanner with 1,496 credential pairs.
   • Dedicated scanners for SSH, HTTP, and Android Debug Bridge (ADB).
   • A web application vulnerability scanner targeting RCE targets.

Persistence Mechanisms and Anti-Analysis Evasion

The malware implements multiple techniques to ensure long-term persistence on compromised operating systems:

• Creation of a systemd service disguised as sd-pam.service with Restart=always.
• Crontab entry injection (@reboot and 5-minute intervals).
• Shell profile injection into .bashrc, .profile, and .zshrc.
• A robust Anti-VM module featuring a weighted scoring system evaluating over 10 detection vectors (DMI checks for VMware/VirtualBox/QEMU, MAC address prefixes, CPU counts, timing-based analysis, and memory footprint inspection in /proc for Mirai, QBOT, Vamp signatures, alongside detection tools like gdb, IDA, Ghidra, and Wireshark).

Command and Control (C2) Architecture and Resilience Channels

The C2 server is built in Go backed by a MariaDB database, maintaining three main TCP listeners: port 1999/31337 (encrypted bot protocol using X25519 and ChaCha20-Poly1305), port 2222 (interactive SSH server for operators hosting the DDoS-for-hire panel), and port 9999 (JSON-based machine API).

If the primary channel fails, the malware falls back to secondary communication mechanisms:

• DGA (Domain Generation Algorithm): Generates 20 daily domains using SHA-512 hashes based on time-dependent seeds.
• P2P Gossip: Peer-to-peer communication over TCP port 13337 utilizing Ed25519-signed commands.
• DNS TXT queries, alongside secondary fallback implementations via IRC and HTTP polling (which remain non-functional in analyzed binaries due to XOR decryption key mismatches).

Affected Systems / Environments

The framework is built to compile and execute across heterogeneous Linux environments, impacting embedded IoT devices as well as exposed network servers:

• Supported Architectures (17 targets): x86_64, ARM (ARM32, ARM7, ARM64/AArch64), MIPS (MIPS, MIPSEL, MIPS64, MIPS64EL), PowerPC (PPC, PPC64LE), RISC-V (riscv64), SuperH (sh4), Motorola m68k, HP PA-RISC (hppa), IBM S/390x, and SPARC64.
• Vulnerable Devices and Servers via integrated exploits: Enterprise routers, F5 BIG-IP devices, web servers running Java Spring MVC/Spring WebFlux applications on Tomcat, DrayTek Vigor gateways, and web hosting control panels (Control Web Panel 7).

Mitigation and Detection

Remediation

1. Firmware Updates and Vendor Patches: Apply official security patches immediately for all listed CVEs (F5 BIG-IP, Spring Framework, DrayTek Vigor, and Control Web Panel 7).
2. Network Hardening: Disable public Internet exposure of Telnet and SSH management services on IoT devices and edge infrastructure; restrict remote administration to internal networks or secure VPN tunnels.
3. Perimeter Filtering: Block outbound traffic destined for known malicious infrastructure IPs linked to the C2 server and payload droppers.

Detection

Defensive teams should monitor log files for Telnet brute-force patterns and network signatures corresponding to C2 handshake handshakes or specific artifact strings.

Threat Warning: The appearance of the console banner Infected By Akiru, combined with mass outbound connection attempts to C2 panel ports and lookups to SHA-512 generated DGA domains, confirms active infection by Keksec/AISURU botnet ecosystem variants.

Key Indicators of Compromise (IoCs)

• SHA256 Hash of Sample Build (x86_64 Debug): 71dfbb171eca4ef9d02ff630b56e5283bbef7b375d4dbe9e8c9531bef312fa8d
• C2 Infrastructure: 209.182.237[.]133 (Ports 1999, 2222, 9999)
• Dropper Server: 185.10.68[.]127 (Paths /bins/bot.<arch>)
• Host Artifacts: Lock file /tmp/.%08x.lock and systemd service sd-pam.service.

Wrapping Up

TuxBot v3 Evolution represents a significant milestone in IoT botnet engineering by incorporating AI-assisted development, resilient control channels with modern encryption, and mass cross-platform compilation. Although initial specimens exhibited logic flaws and encryption errors introduced by uncritical LLM usage, the ease with which these bugs can be patched demonstrates that AI-developed threats are transitioning from experimental prototypes to highly automated and dangerous attack vectors. Rigorous patching schedules for critical RCE vulnerabilities and strict perimeter control policies remain paramount to mitigating the proliferation of these botnets.

References

• The Hacker News. (2026). TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development. Unit 42 Palo Alto Networks.
• NVD - National Vulnerability Database. CVE-2022-1388 Detail. Retrieved from official NVD datasets.
• NVD - National Vulnerability Database. CVE-2022-22965 Detail. Retrieved from official NVD datasets.
• NVD - National Vulnerability Database. CVE-2020-8515 Detail. Retrieved from official NVD datasets.
• NVD - National Vulnerability Database. CVE-2022-44877 Detail. Retrieved from official NVD datasets.