TuxBot v3: IoT Botnet with LLM-Assisted Development

TuxBot v3 Evolution is a newly identified IoT botnet framework linked to the Akiru and Keksec ecosystems. The framework is notable for the explicit use of Large Language Models (LLMs) in its development, evidenced by raw LLM reasoning and safety disclaimers left in the source code. While the LLM accelerated development, it also introduced critical bugs, such as XOR key mismatches and broken cryptographic implementations, which partially hindered its exploit capabilities in analyzed samples.

The framework is highly modular, featuring a Go-based C2 server, an automated build system for 17 target architectures, and diverse C2 channels including DGA, P2P gossip, and DNS TXT queries. Despite functional gaps in its exploit VM, the core infection vectors—Telnet/SSH brute-forcing and dedicated RCE scanners—remain fully operational. The presence of active infrastructure since March 2026 and shared dropper servers with Kaitori and AISURU indicates a sophisticated, multi-variant operation.

For organizations, TuxBot represents an evolving threat where AI assistance lowers the barrier to entry for creating complex botnet frameworks. Although analyzed versions contained flaws, the ease with which these can be corrected suggests that more polished and lethal iterations are likely active in the wild, posing a significant risk for DDoS attacks and wide-scale IoT compromise.