KATARU IoT Malware Exploits Linux Vulnerabilities for DDoS Attacks

• •KATARU malware exploits Linux vulnerabilities to escalate privileges and launch DDoS attacks.
• •The malware uses Telnet brute-forcing and includes multiple public exploits like CVE-2026-46300.
• •It features extensive persistence mechanisms, making it difficult to remove once deployed.

The KATARU malware targets internet-exposed IoT devices using Telnet credential brute-forcing. Once access is gained, it attempts to escalate privileges using public Linux exploits, including CVE-2026-46300, CVE-2026-43284, and CVE-2026-31431. The malware combines Mirai-style DDoS capabilities with encrypted command-and-control communications and extensive persistence mechanisms. It was first identified in August 2026 after a honeypot was compromised by an attacker from Vietnam. The malware's architecture indicates it may have been developed with AI assistance, as it includes misconfigured exploit code and lacks adequate testing for target architectures. KATARU's persistence methods are notably broad, affecting various Linux and embedded systems. The malware has been confirmed to contain x86-oriented shellcode despite being an ARM binary, suggesting a lack of proper adaptation by its authors. Security experts recommend immediate defensive measures against this evolving threat.