New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai

Cybersecuritynews •Tushar Subhra Dutta • September 11, 2026

KATARU is a newly observed IoT malware strain that can turn poorly secured devices into DDoS attack nodes. The sample was captured after an attacker used repeated Telnet password guesses against a honeypot, then downloaded an ARM payload. It shows how old entry points still give attackers a foothold. The malware resembles the Mirai botnet […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

KATARU IoT Malware Exploits Linux Vulnerabilities for DDoS Attacks The KATARU malware targets internet-exposed IoT devices using Telnet credential brute-forcing. Once access is gained, it attempts to escalate privileges using public Linux exploits, including CVE-2026-46300, CVE-2026-43284, and CVE-2026-31431. The malware combines Mirai-style DDoS capabilities with encrypted command-and-control communications and extensive persistence mechanisms. It was first identified in August 2026 after a honeypot was compromised by an attacker from Vietnam. The malware's architecture indicates it may have been developed with AI assistance, as it includes misconfigured exploit code and lacks adequate testing for target architectures. KATARU's persistence methods are notably broad, affecting various Linux and embedded systems. The malware has been confirmed to contain x86-oriented shellcode despite being an ARM binary, suggesting a lack of proper adaptation by its authors. Security experts recommend immediate defensive measures against this evolving threat. 7 sources 73

Extracted Entities

New KATARU IoT Malware Packs Linux Privilege Escalation Exploits and Mirai

The full story

Extracted Entities

Attack Types (3)

CWE Weaknesses (1)

Malware (2)

MITRE ATT&CK (2)

Platforms (1)