Keksec

Keksec, also styled #keksec, is a financially motivated cybercrime group active since 2016 that develops and operates IoT, Linux, and Windows botnets. The group has been associated with the Necro, Gafgyt, Gafgyt_tor, Tsunami, EnemyBot, Simps, and LOLFME malware families. It is known for operating multiple botnet variants in parallel and for rapidly incorporating publicly disclosed vulnerabilities and weak or default credentials into large-scale propagation campaigns targeting internet-exposed routers, IoT devices, web applications, and servers. Keksec operations support distributed denial-of-service activity, including DDoS-based extortion, cryptocurrency mining, information theft, and malware distribution. Its malware commonly performs internet-wide service scanning, Telnet and SSH credential attacks, exploitation of known remote-code-execution vulnerabilities, multi-architecture payload delivery, and command-and-control obfuscation through Tor services and domain-generation techniques. EnemyBot and related tooling reuse components from Mirai and Gafgyt-derived codebases while adding broad exploit coverage and multiple DDoS methods. Necro is Keksec's most feature-rich known platform. It has targeted Linux and Windows hosts, deployed cryptominers, performed web-file injection to deliver browser-resident theft and DDoS functionality, and used rootkit-assisted process and artifact concealment on Windows through in-memory process injection. Browser-oriented payloads associated with Necro support keylogging, form-data collection, cookie and clipboard theft, and browser-based DDoS activity. Across its malware families, Keksec has also used packet sniffing, process masquerading, anti-analysis measures, and mechanisms to remove competing malware. LOLFME variants associated with Keksec have incorporated destructive device-wiping logic, including behavior intended to erase storage, disrupt networking, and reboot infected devices. Available evidence did not establish widespread deployment of these destructive functions. TuxBot v3 Evolution has infrastructure and tooling overlaps with the broader Keksec ecosystem, including Kaitori and AISURU-related activity, but this connection is an ecosystem-level assessment rather than conclusive attribution of TuxBot operations directly to Keksec.