New IoT Malware Uses Public Linux Exploits to Gain Root and Turn Devices Into DDoS Bots

A newly identified IoT malware family named KATARU is targeting Linux-based devices through Telnet credential brute-force attacks, then attempting to gain root access and enlist compromised systems into a DDoS botnet. The malware was observed after attackers brute-forced Telnet credentials on a honeypot from the IP address 160[.]191.242.92 . Following successful access, the attacker used BusyBox commands to download and run an ARM payload named vlxx.arm . KATARU shares…

Diamond Model