New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

Gbhackers •Mayura Kathir • September 11, 2026

A newly observed IoT malware family dubbed KATARU targets internet-exposed devices through Telnet credential brute-forcing, then attempts to gain root privileges with publicly available Linux kernel exploits before enrolling compromised systems in a DDoS botnet. The sample combines familiar Mirai-style flooding functions with encrypted command-and-control, broad persistence logic, anti-analysis checks and decoy network activity designed […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

KATARU IoT Malware Exploits Linux Vulnerabilities for DDoS Attacks The KATARU malware targets internet-exposed IoT devices using Telnet credential brute-forcing. Once access is gained, it attempts to escalate privileges using public Linux exploits, including CVE-2026-46300, CVE-2026-43284, and CVE-2026-31431. The malware combines Mirai-style DDoS capabilities with encrypted command-and-control communications and extensive persistence mechanisms. It was first identified in August 2026 after a honeypot was compromised by an attacker from Vietnam. The malware's architecture indicates it may have been developed with AI assistance, as it includes misconfigured exploit code and lacks adequate testing for target architectures. KATARU's persistence methods are notably broad, affecting various Linux and embedded systems. The malware has been confirmed to contain x86-oriented shellcode despite being an ARM binary, suggesting a lack of proper adaptation by its authors. Security experts recommend immediate defensive measures against this evolving threat. 4 sources 73

Extracted Entities

New IoT Malware Uses Public Linux Exploits to Gain Root and Launch DDoS Attacks

The full story

Extracted Entities

Attack Types (2)

Malware (2)

MITRE ATT&CK (2)

Platforms (1)