Reported by 4 outlets
IoT Malware Uses Public Linux Exploits to Gain Root and Turn Devices Into DDoS Bots
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 4.40 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
KATARU is a new IoT malware family that Nozomi Networks Labs first documented on September 9 after its honeypot fell to Telnet credential brute forcing from 160.191.242.92, which then used BusyBox to pull an ARM payload named vlxx.arm. The surface behavior is Mirai-style DDoS and brute forcing, but the escalation stage is what separates it from the daily botnet churn: it first checks whether /etc/passwd is writable and rewrites root:x: to root:: for a passwordless su, then falls back to unmodified public exploit code for CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), and CVE-2026-31431 (Copy Fail), plus a cgroup v1 release_agent escape via /sys/fs/cgroup/memory/release_agent. Command and control runs as a custom X25519 and ChaCha20-Poly1305 channel on TCP port 6767, wrapped in anti-analysis checks, a decoy-traffic generator, and persistence across systemd, cron, rc scripts, OpenWrt procd, and Android init.
The escalation stage is the story, not the DDoS. All three embedded bugs are page-cache corruption LPEs disclosed between April 29 and May 13, 2026, and each yields deterministic root on kernels shipped continuously since about 2017: DirtyFrag's xfrm-ESP bug (CVE-2026-43284) covers every kernel from commit cac2661c53f3 in January 2017 to the May 5, 2026 fix, roughly nine years of vulnerable code, and Copy Fail's authors note the same primitive crosses container boundaries to the host. Embedded and IoT vendors freeze kernel versions for years, so a Telnet-exposed router is unlikely to carry any of the three fixes, which upgrades what used to be a user-level, wipe-and-forget Mirai infection into durable root with immutable, append-only persistence. That changes the remediation math for a compromised device from cleanup to reflash or replacement. A second-order problem: KATARU's decoy layer deliberately mixes RFC 5737 documentation ranges with real GitHub and Cloudflare addresses, so automated IOC extraction from this sample will accuse benign infrastructure.
Block Telnet (TCP 23) ingress to managed devices and confine administration to management networks or a VPN; the brute-force source 160.191.242.92 also appears in the IoC list as C2. Patch kernels carrying the upstream fixes: f4c50a4034e6 and aa54b1d27fe0 for the DirtyFrag components, a664bf3d603d for Copy Fail. Where firmware cannot be patched, rmmod esp4 esp6 rxrpc and blacklist those modules plus algif_aead via /etc/modprobe.d. Hunt for the artifacts Nozomi published: outbound TCP 6767, writes to /sys/fs/cgroup/memory/release_agent and /tmp/.cg_escape.sh, a systemd unit named network-dispatch, root:: appearing in /etc/passwd, files flipped immutable and append-only in startup paths, and the sample hashes led by 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4 against the IOT_DDOS_KATARU_sample YARA rule. Note that this exploit class corrupts memory pages without touching the disk file, so file-integrity checking will not catch a backdoored su; treat unexplained su executions from service accounts as escalation evidence.
Two developments would change the assessment. The exploit code in the analyzed build targets x86 while the payload is ARM, so the LPE stage likely fails as shipped; a ported version, or the same three PoCs surfacing in other Mirai forks, would move this from curiosity to fleet-wide root escalation. Failing that, watch for KEV listing or broader telemetry showing CVE-2026-46300, CVE-2026-43284, or CVE-2026-31431 exploited beyond a single honeypot, which would force prioritization across the entire unpatchable embedded base rather than just Telnet-exposed devices.
Timeline
-
original reporting
IoT Malware Uses Public Linux Exploits to Gain Root and Turn Devices Into DDoS Bots
cyberpress.org · 32d ago · September 11th, 2026
A newly identified IoT malware family named KATARU is targeting Linux-based devices through Telnet credential brute-force attacks, then attempting to gain root access and enlist compromised systems into a DDoS botnet. The malware was observed after attackers brute-forced Telnet credentials on a honeypot from the IP address 160[.]191.242.92 . Following successful access, the attacker used BusyBox commands to download and run an ARM payload named vlxx.arm . KATARU shares several features with Mirai-style botnets, including DDoS attack functions and brute-force capabilities. However, researchers found that it also includes a broad set of Linux privilege-escalation exploits, persistence methods, encrypted command-and-control communications, anti-analysis checks, and decoy network traffic. Linux Exploits Create Botnets After execution, KATARU first checks whether /etc/passwd is writable. If it is, the malware attempts to remove the root password placeholder, allowing the attacker to run su and gain root privileges without entering a password. If that method fails, the malware tries several public Linux local privilege-escalation exploits, including code for CVE-2026-46300, known as Fragnesia; CVE-2026-43284, called DirtyFrag; and CVE-2026-31431, known as Copy Fail. Decompilation of exploit code found in the sample (Source: nozominetworks) The sample also attempts a cgroup v1 release_agent escape. This technique writes a script that relaunches the malware and attempts to configure
-
update from xint.io
Copy Fail: 732 Bytes to Root on Every Major Linux Distribution (CVE-2026-31431)
xint.io · 168d ago · April 29th, 2026
Xint Code (Theori) disclosed CVE-2026-31431 on April 29, 2026: a logic bug in the Linux kernel's authencesn AEAD template that gives an unprivileged local user a deterministic 4-byte write into the page cache of any readable file, chained from AF_ALG and splice(). A 732-byte Python PoC corrupts the in-memory /usr/bin/su to obtain root on Ubuntu 24.04, Amazon Linux 2023, RHEL 10.1, and SUSE 16, and the same primitive crosses container boundaries because the page cache is shared with the host. The bug was reported to the kernel security team on 2026-03-23, fixed in mainline commit a664bf3d603d, and assigned its CVE on 2026-04-22; the immediate mitigation is blocking algif_aead via /etc/modprobe.d.
-
update from github.com
Fragnesia: CVE-2026-46300 public PoC (V12 Security disclosures repo)
github.com · 153d ago · May 13th, 2026
V12 Security published the Fragnesia exploit in its public disclosure repository on 2026-05-13 (first commit in the fragnesia path). Fragnesia (CVE-2026-46300, CVSS 7.8) is a universal Linux local privilege escalation discovered by William Bowling with the V12 team: a logic bug in the XFRM ESP-in-TCP subsystem lets an unprivileged user write attacker-controlled bytes into the kernel page cache of read-only files, overwriting /usr/bin/su in memory for a root shell while the on-disk binary stays untouched. It is a separate bug from Dirty Frag in the same attack surface, with its own patch posted to netdev the same day, and shares the same mitigation of removing and blacklisting the esp4, esp6, and rxrpc modules.
-
update from nozominetworks.com
KATARU: IoT Malware Adopts Public LPE Exploits
nozominetworks.com · 35d ago · September 9th, 2026
Nozomi Networks Labs published the original KATARU analysis on September 9, 2026, two days before the trade-press coverage. The infection was observed in August after Telnet credential brute forcing against one of their honeypots from an IP in Vietnam (160.191.242.92), which used BusyBox to fetch and run an ARM payload saved as vlxx.arm (SHA-256 13382c16e2401b07451577b46e634b8031ec254d98b876e59692b5fa22abc1d4). The report details the three embedded public LPE exploits (CVE-2026-46300 Fragnesia, CVE-2026-43284 DirtyFrag, CVE-2026-31431 Copy Fail), the custom X25519/ChaCha20-Poly1305 C2 on TCP port 6767, a decoy-traffic layer mixing RFC 5737 ranges with real GitHub and Cloudflare addresses, and implementation artifacts (x86 shellcode in an ARM build, a pinned X25519 key matching the RFC 7748 Alice test vector) pointing to AI-assisted assembly. It publishes a YARA rule (IOT_DDOS_KATARU_sample), sample hashes, and the full IoC set.