Case unit42-tuxbot-v3-llm-botnetAI-assisted malwareWorldwide
TuxBot v3: Keksec-linked IoT botnet built with LLM help keeps safety disclaimers
Unit 42 recovered the TuxBot v3 Evolution framework whose 61 C files carry an unremoved LLM safety disclaimer and chain-of-thought comments; about 70 percent works, including Telnet brute force and DDoS.
MediumAttack using AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jul 16, 2026
- Location
- Worldwide
- Target
- Linux IoT devices across 17 architectures
- Severity
- Medium
- Triggered by
- Keksec ecosystem operator
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Unit 42 recovered the TuxBot v3 Evolution framework whose 61 C files carry an unremoved LLM safety disclaimer and chain-of-thought comments; about 70 percent works, including Telnet brute force and DDoS.
Impact: Operational DDoS capability; infection counts not reported. Several claimed features such as Argon2id hashing and the exploit VM were non-functional.
Who triggered it
Actor: Keksec ecosystem operator
Attribution: Unit 42 links the operator to Keksec via shared Kaitori v3.9 and AISURU dropper infrastructure; a Git log leaked an Iranian-hosted hostname.
Motive: DDoS-for-hire
How it happened
Attack vector: Telnet, SSH, HTTP and ADB scanners, exploits for 30-plus IoT families, Go C2 with DDoS panel
Root cause: LLM-generated code let a low-skill developer assemble a large framework, bugs and disclaimers included
Timeline
- C2 infrastructure active from at least this month
- Unit 42 sees six new samples in telemetry
- Unit 42 publishes analysis
Response
Unit 42 published IOCs and noted it fixed several bugs with a few prompts, warning more polished versions likely exist.
Current status: Ongoing
Sources (open in a new tab)
- Unit 42 unit42.paloaltonetworks.com
- Security Affairs securityaffairs.com
- The Hacker News thehackernews.com
Cite this case
TuxBot v3: Keksec-linked IoT botnet built with LLM help keeps safety disclaimers. AI Threat Watch, case unit42-tuxbot-v3-llm-botnet, Jul 16, 2026. https://aithreat.io/cases/unit42-tuxbot-v3-llm-botnet/
Permanent link: https://aithreat.io/cases/unit42-tuxbot-v3-llm-botnet/