RondoDox/IoT Botnet Multi-Stage Payload Delivery Kill Chain (wget/chmod/rm)

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects a multi-stage infection sequence characteristic of common IoT botnets (such as Mirai variants). The detection triggers when a sequence of events occurs on the same device within a 5-minute window: downloading a file from a URL using wget or curl to /tmp/, modifying the file permissions using chmod 777, and subsequently executing the binary. An optional cleanup phase involving removal of files from /tmp/ is also correlated.