Researchers at Nozomi Networks Labs have uncovered Kairos, an uncharted Linux botnet that disrupts services by maintaining vast numbers of open TCP connections rather than generating substantial traffic. These devices establish hundreds or thousands of connections to a designated target and send minimal messages to keep them active. Initially, the researchers captured three samples through honeypots.
A deeper investigation into VirusTotal revealed five new samples targeting ARM, MIPS, and 32-bit x86 systems, along with the original amd64 builds.
They utilized wget, curl, and BusyBox wget as download methods, ensuring compatibility across various Linux environments. Upon activation, the bot connects to a hardcoded command-and-control address, sending a plaintext registration message detailing its OS, architecture, and CPU count. The decompiled holdConn reveals a five-second ticker and a single-byte 0x20 write to keep each socket open.
Researchers found no persistence, self-propagation, arbitrary command execution, or additional payload downloading inside the analyzed binaries, nozominetworks said.
Indicators of Compromise Indicator Type Role / Associated Ports 103.124.165.53 IPv4 address Attacker IP observed delivering Kairos 45.129.56.140 IPv4 address Attacker IP observed delivering Kairos Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
