KATARU IoT Botnet + Mirai-Style DDoS: OTX Pulse Analysis — Telnet Brute-Force, Public Linux LPE Exploits, and Encrypted C2 Detection Pack

Threat Summary

The pulse describes KATARU, an IoT-focused malware variant first observed in August 2026 after Telnet credential brute-forcing against a honeypot infrastructure attributed to Vietnam. The operation retains the economics of classic Mirai-style botnets: scan for exposed Telnet, try default or weak credentials, drop an architecture-appropriate payload, conscript the device into a DDoS-capable botnet, and hide behind encrypted command-and-control. The differentiator is the reported use of multiple public Linux local privilege escalation exploits and broader persistence logic across both Linux hosts and embedded platforms.

The collective signal is not a credential-phishing campaign; it is credential theft and infrastructure capture at the network edge. Attackers are converting unmanaged routers, cameras, DVR/NVRs, small Linux appliances, and forgotten SSH/Telnet-enabled systems into bots that can be used for DDoS, proxying, follow-on exploitation, and potential initial access into adjacent enterprise networks. The CVE indicators — CVE-2026-31431, CVE-2026-43284, and CVE-2026-46300 — should be treated as exploit dependencies to validate in asset inventories rather than proof of exploitation in every environment. The operational objective appears to be durable botnet growth with privilege escalation where possible, then resilient encrypted C2 for tasking.

Threat Actor / Malware Profile

No named adversary is attributed in the pulse; the actor is currently unknown. KATARU is profiled with Mirai lineage or Mirai-style behavior, meaning defenders should expect rapid scanning, credential stuffing against Telnet, architecture-specific binaries, process masquerading, and DDoS tasking. Distribution begins with inbound Telnet brute-force against exposed devices, followed by a downloader or direct binary transfer using common embedded utilities such as wget, curl, tftp, ftpget, or busybox applets.

Payload behavior likely includes: checking CPU architecture, writing to writable paths such as /tmp, /var/tmp, /dev/shm, or flash-backed configuration directories; removing competing malware; killing or renaming legitimate services; and establishing persistence through cron, rc.local, init scripts, systemd units, profile files, or watchdog-compatible service managers. The reported LPE exploits suggest KATARU attempts root where it lands as a limited user, then weakens controls by disabling logging, altering firewall rules, or adding users and SSH keys if the target is a fuller Linux host rather than a constrained appliance.

C2 communication is described as encrypted, which reduces the value of simple string-based network signatures. Defenders should pivot to infrastructure indicators, JA3/JA3S where TLS is used, periodic beacon timing, uncommon destination ports, repeated short flows from IoT VLANs, and DNS patterns if present in related telemetry. Anti-analysis techniques should be assumed: packed or stripped ELF binaries, fake process names, timestomping, log deletion, sandbox or honeypot checks, and selective execution only after confirming outbound connectivity.

IOC Analysis

The pulse contains CVE indicators, one IPv4 address, and four SHA256 file hashes. CVEs are vulnerability-context indicators, not direct block artifacts; use them to drive exposure validation, firmware prioritization, and exploit-path review. The IPv4 indicator 160.191.242.92 should be treated as a high-confidence block and hunt candidate for egress, ingress scanning, DNS resolution, NetFlow, proxy, firewall, EDR network events, and cloud security group logs.

The SHA256 indicators are most useful for EDR file reputation, Linux integrity monitoring, YARA/Sigma hash matching where supported, and retro hunts across /tmp, /var/tmp, /dev/shm, user home directories, web roots, container image layers, and backup-mounted snapshots. SOC teams should operationalize indicators by: pushing the IP to deny lists for 30-90 days with owner and expiry; adding hashes to EDR block/quarantine policies; searching authentication logs for Telnet brute-force bursts; and enriching any hit with device owner, firmware, VLAN, internet exposure, and whether the asset can reach internal production segments.

Recommended tooling: EDR for hash and network retro-hunts, Zeek/Suricata for Telnet and C2 metadata, Firewall/NetFlow for IoT VLAN egress baselines, Sentinel/Defender for managed Linux endpoints, OpenSCAP or Lynis for Linux configuration drift, Nessus/Qualys for CVE exposure, and MISP/ThreatConnect for indicator lifecycle. For constrained IoT, mirror network telemetry through SPAN/TAP and control-plane logs rather than assuming an agent exists.

Detection Engineering

---
title: KATARU IoT Telnet Brute-Force and Downloader Staging
id: 9f4a1c2e-kataru-001
status: experimental
description: Detects Telnet brute-force bursts followed by shell-based download or execution of ELF payloads commonly used by Mirai-style and KATARU IoT botnets.
author: Security Arsenal
logsource:
  product: linux
  service: auth
detection:
  selection_auth:
    - 'Failed password'
    - 'authentication failure'
    - 'invalid user'
  selection_proto:
    - 'telnet'
    - 'port 23'
    - 'port 2323'
  condition: selection_auth and selection_proto
falsepositives:
  - Legacy management stations scanning lab devices
  - Authorized vulnerability scanners with documented windows
level: high
tags:
  - attack.t1110
  - attack.t1078
  - attack.credential_access
---
title: KATARU Linux Shell Downloader and Architecture Fingerprinting
id: 9f4a1c2e-kataru-002
status: experimental
description: Identifies suspicious embedded-Linux downloader commands, uname or cpuinfo checks, chmod execution, and writes to volatile paths associated with KATARU or Mirai-style staging.
author: Security Arsenal
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/busybox'
      - '/wget'
      - '/curl'
      - '/tftp'
      - '/ftpget'
  selection_cli:
    CommandLine|contains:
      - 'wget '
      - 'curl '
      - 'tftp '
      - 'busybox'
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - 'chmod +x'
      - 'uname -m'
      - '/proc/cpuinfo'
  condition: selection_img and selection_cli
falsepositives:
  - Firmware update scripts
  - Embedded device diagnostics approved by operations
level: high
tags:
  - attack.t1105
  - attack.t1059
  - attack.t1082
---
title: KATARU Linux or Embedded Persistence via Cron Init SystemD
id: 9f4a1c2e-kataru-003
status: experimental
description: Detects persistence writes to cron, rc.local, init.d, systemd, profile, or watchdog paths followed by service reloads or shell execution from temporary paths.
author: Security Arsenal
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/etc/cron'
      - '/var/spool/cron'
      - '/etc/rc.local'
      - '/etc/init.d/'
      - '/etc/systemd/system/'
      - '/etc/profile'
      - '/etc/profile.d/'
      - '/root/.bashrc'
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
  selection_name:
    TargetFilename|contains:
      - 'kataru'
      - 'mirai'
      - '.update'
      - ' watchdog'
      - 'sysup'
  condition: selection_path or selection_name
falsepositives:
  - Package manager service installation
  - Configuration management from Ansible, Puppet, or vendor agents
level: medium
tags:
  - attack.t1053
  - attack.t1543
  - attack.t1546

let BadIP = dynamic(['160.191.242.92']);
let BadHashes = dynamic(['9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5','cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218','13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4','6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f']);
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteIP in (BadIP) or RemotePort in (23,2323,5555,7547,8291)
| project TimeGenerated, DeviceName, LocalIP, LocalPort, RemoteIP, RemotePort, Protocol, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceProcessEvents
| where SHA256 in (BadHashes)
   or ProcessCommandLine has_any ('wget ','curl ','tftp ','busybox','/tmp/','/var/tmp/','/dev/shm/','chmod +x','uname -m','/proc/cpuinfo','telnet')
| project TimeGenerated, DeviceName, AccountName, FileName, SHA256, ProcessCommandLine, InitiatingProcessCommandLine),
(DeviceFileEvents
| where SHA256 in (BadHashes) or FolderPath has_any ('/tmp/','/var/tmp/','/dev/shm/','/etc/cron','/etc/rc.local','/etc/init.d/','/etc/systemd/system/')
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, ActionType, InitiatingProcessCommandLine)
| sort by TimeGenerated desc

#!/usr/bin/env bash
# Read-only KATARU hunt for Linux gateways, sensors, and manageable IoT-adjacent hosts.
BAD_IP='160.191.242.92'
HASHES='9d7cd4948a1fcbaeadc425752fce9a933bd6fc41eeede030dffd7b99b3bc51d5
cc76bc218627279ecb4d0ce74ad2651e9db9e3e843e35d6569576e056e3a9218
13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4
6fbae3505ae0d638b820165c572d548ce92dda71e82dc47e8efe13f30617f35f'

echo '[network] live connections and listeners'
(ss -tanp 2>/dev/null || netstat -tanp 2>/dev/null) | grep -E "${BAD_IP}|:23|:2323|:5555|:7547|:8291" || true

echo '[process] downloader, telnet, and volatile-path execution'
ps auxww | grep -Ei 'wget|curl|tftp|busybox|telnet|/tmp/|/var/tmp/|/dev/shm/|kataru|mirai' | grep -v grep || true

echo '[hashes] scanning likely staging paths'
printf '%s
' "$HASHES" > /tmp/kataru_hashes.$$
find /tmp /var/tmp /dev/shm /home /root /opt /srv -type f -size -50M -print0 2>/dev/null | while IFS= read -r -d '' f; do
  h=$(sha256sum "$f" 2>/dev/null | awk '{print $1}')
  grep -qx "$h" /tmp/kataru_hashes.$$ && echo "HASH_MATCH $h $f"
done
rm -f /tmp/kataru_hashes.$$

echo '[persistence] cron init systemd profile rc.local artifacts'
grep -RIlE 'kataru|mirai|wget |curl |tftp |/tmp/|/var/tmp/|/dev/shm/' /etc/cron* /var/spool/cron /etc/rc.local /etc/init.d /etc/systemd/system /etc/profile /etc/profile.d /root/.bashrc 2>/dev/null || true
systemctl list-unit-files 2>/dev/null | grep -Ei 'kataru|mirai|sysup|update|watchdog' || true

echo '[auth] telnet or password burst indicators'
grep -Ei 'Failed password|authentication failure|invalid user|telnet' /var/log/auth.log /var/log/secure /var/log/messages 2>/dev/null | tail -n 200 || true

Response Priorities

• Immediate: block and alert on 160.191.242.92 at egress, ingress, DNS, proxy, cloud security groups, and IoT VLAN policy; add the four SHA256 values to EDR block lists; isolate any asset with Telnet exposed to untrusted networks; hunt for /tmp, /var/tmp, /dev/shm execution, cron/rc.local/systemd modifications, and Telnet brute-force bursts; disable Telnet where SSH or vendor management APIs are available.
• 24h: force credential rotation for devices, service accounts, router/NVR admin panels, and any Linux account that shares passwords with edge infrastructure; review whether stolen device credentials could replay into VPN, Wi-Fi controllers, CI runners, or management jump hosts; validate no default vendor credentials remain; capture volatile memory from managed Linux hosts and export logs before appliances overwrite them.
• 1 week: segment IoT/OT from production with deny-by-default east-west rules; require outbound allow-listing for IoT VLANs; patch or firmware-upgrade assets mapped to CVE-2026-31431, CVE-2026-43284, and CVE-2026-46300 after vendor confirmation; deploy network detection for Telnet and encrypted beaconing from unmanaged devices; establish an immutable firmware baseline and canary credentials for edge management planes.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub