Loading malware…
Tsunami is an open-source, Linux-based IRC botnet and backdoor derived from Kaiten, also known as Titan or Ziggystartux. It connects compromised systems to an IRC command-and-control server and accepts instructions to execute shell commands, download files, and launch distributed denial-of-service attacks. It targets Linux servers, cloud instances, containerized workloads, and embedded devices, including routers. Observed deployments include binaries selected for 32-bit and 64-bit hosts, while IoT variants support architectures such as MIPS.
Attackers deploy Tsunami after exploiting vulnerable internet-facing applications or abusing exposed, misconfigured services. Documented infection vectors include Jenkins dashboard misconfigurations, exposed Docker daemons, Oracle WebLogic vulnerabilities, and Log4Shell exploitation. Router-targeting variants have incorporated command-injection exploits, including CVE-2017-17215 and CVE-2014-8361. Infection chains commonly use shell scripts to retrieve and execute compatible payloads.
Tsunami has been used by TeamTNT, the 8220 Gang, and Keksec. In cloud-focused cryptojacking campaigns, it supplies remote access alongside separately deployed cryptocurrency miners; mining is not an established core Tsunami capability. Keksec-modified variants include Telnet weak-password scanning, vulnerability scanning, and packet-sniffing functionality that forwards selected TCP traffic to command-and-control infrastructure. Some observed samples use encrypted IRC messages. Its open-source lineage and modification by multiple operators produce substantial variation in functionality and deployment practices.
15 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 more CVEs associated with this family tracked in Mallory.
6 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tsunami - An open-source botnet, aslo known as titan or ziggystartux, used to perform DDoS attacks against targets or to execute commands on the infected machine.
Further analysis shows that this IP and another Necro C2 IP 193.239.147.224 were also used as C2 by other versions of Gafgyt and Tsunami botnet in early February, which apparently share code with Gafgyt_tor.
Keksec actively maintains three main families, Gafgyt, Tsunami and Necro, with new features constantly being added.
Further, it makes a bunch of references to a TSUNAMI payload which STRIKE hasn’t analyzed, and its role is unknown.
During our analysis we were able to identify a more comprehensive sample of the Tsunami-Framework, a Malware relying on the TOR-Network and Pastebin for command and control. Tsunami has a modular structure, incorporates multiple stealers and deploys two cryptominers.
53 distinct techniques documented for this family, organized by ATT&CK tactic.
T1589.001 Gather Victim Identity Information: Credentials Multiple modules collect credentials from browsers and other applications.
Based on our research, we have discerned that this botnet perpetually scans the entirety of the internet... every IP address undergoes a scan at least once every hour.
We can see that Keksec launched scans and attacks on targets across the network almost non-stop. Our honeypots see new variants and exploits all the time, with the exception of some occasional breaks. When a new exploit is introduced, the scans increase significantly.
T1584.005 Compromise Infrastructure: Botnet The malware includes Botnet functionality.
T1587.001 Develop Capabilities: Malware The Threat Actor actively develops the Tsunami malware.
“toolset blends… rootkit-class artifacts… PhoenixMiner… Linux.Cryptominer.Camelot… EnergyMech… Tsunami… Keiten… large back-catalog of Linux 2.6.x-era exploits”
T1608 Stage Capabilities The infection chain relies on multiple stages hosted on different systems and services.
The infection sequence initiates with the transmission of a meticulously crafted HTTP request by an attacker to a designated system employing Log4j.
In 2016, a variant of Tsunami was used in the Linux Mint hack, where an unknown threat actor compromised the Linux Mint distribution ISOs to include a backdoor.
T1566 Phishing ... The Threat Actor approaches their victims via LinkedIn and poses as a potential business partner.
Hadooken, in turn, drops and executes a cryptominer and the Tsunami malware and then sets up multiple cron jobs with randomized names and payloads execution frequencies.
It then adds a Windows-Defender Exclusion for the “Runtime Broker.exe” and creates a Scheduled Task for secondary persistence.
They ran the container with the --restart=always flag, which means that if for some reason the container stops it will always attempt restarting.
The mass scanning activity observed so far has involved attempts at installing several cryptocurrency miners and the Tsunami backdoor.
In terms of execution and the download command is a bash implementation used to download scripts and binaries from the C2 server.
The vulnerability, CVE-2021-44228, also named #Log4Shell allows for unauthenticated remote code execution and is trivial to exploit.
T1204 User Execution The Initial Access relies on the user executing a backdoored GitHub repository.
The tool is used to hide processes using LD_PRELOAD . The shared object was written to /usr/local/lib/systemhealt.so by the setup script and directives were added to /etc/ld.so.preload
When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.
Hadooken, in turn, drops and executes a cryptominer and the Tsunami malware and then sets up multiple cron jobs with randomized names and payloads execution frequencies.
It then adds a Windows-Defender Exclusion for the “Runtime Broker.exe” and creates a Scheduled Task for secondary persistence.
They ran the container with the --restart=always flag, which means that if for some reason the container stops it will always attempt restarting.
When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.
The launcher deploys a persistent “Tsunami-Injector” named “Windows Update Script.pyw” in “AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup”
When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.
Hadooken, in turn, drops and executes a cryptominer and the Tsunami malware and then sets up multiple cron jobs with randomized names and payloads execution frequencies.
It then adds a Windows-Defender Exclusion for the “Runtime Broker.exe” and creates a Scheduled Task for secondary persistence.
They ran the container with the --restart=always flag, which means that if for some reason the container stops it will always attempt restarting.
in a fileless malware attack, the malware is loaded into memory and then executed. By executing malicious code directly from memory, attackers can evade detection by static scanners
When Tsunami is executed, it writes its own path in the “/etc/rc.local” file, making it so that it runs even after reboots.
The launcher deploys a persistent “Tsunami-Injector” named “Windows Update Script.pyw” in “AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup”
TeamTNT is running the container as a privileged one, and mounting the host, this enables privileged access to the host.
They have used techniques of hiding their running processes by mounting an empty folder over the process entry within the procfs, or by using UserLand and kernel level rootkits... In the Summer campaign, they took this further by using a Linux Kernel Module (LKM) rootkit.
Most of the Gafgyt and Tsunami samples we captured were not packed... String encoding... Necro also cryptographically protects the string by first performing character substitution and then doing zip compression.
a few of the packed samples used the standard UPX shell
A very traditional technique on Linux systems is to use random strings to override argv parameters and prctl(PR_SET_NAME,buf) to change the process name and start parameters in order to disguise the process.
in a fileless malware attack, the malware is loaded into memory and then executed. By executing malicious code directly from memory, attackers can evade detection by static scanners
All of their scripts are designed to be executed without being written to disk or self deleted after execution... When all stages have been downloaded and started, the setup script removes itself from the infected host.
The tool is used to hide processes using LD_PRELOAD . The shared object was written to /usr/local/lib/systemhealt.so by the setup script and directives were added to /etc/ld.so.preload
When the crypter was executed, it would decrypt the payload and write it to a memory only file created with the system call memfd_create ... the spawned child executes the memory file via the execve syscall.
The injected BASH commands above download a file, change its permissions to read/write/execute for all users, and executes the file... chmod 777 /tmp/besh
T1562.001 Impair Defenses: Disable or Modify Tools Windows Defender is being disabled.
T1562.004 Impair Defenses: Disable or Modify System Firewall The Windows Firewall is being disabled.
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
T1056 Input Capture The malware has Keylogging capabilities.
The scanners used by Keksec are mainly telnet and SSH weak password scan and exploit scan.
This post will cover a case where a threat actor managed to log in to poorly managed SSH servers after carrying out dictionary attacks, which was then followed by installing DDoS Bots and XMRig CoinMiner.
T1539 Steal Web Session Cookie The malware exfiltrates Browser Session Cookies.
T1555 Credentials from Password Stores Multiple Applications and Browsers are accessed for credential access.
Packet sniffing is one of the more favoured features of Keksec, and the code can be seen in all three families. The basic function is to capture TCP traffic after filtering out some specified ports and IPs, and to send the remaining data to the C2.
“The core function is still DDoS attacks and scanning”; samples contain scan functions named “ak47Scan” and “ak47telscan.”
T1082 System Information Discovery During Initialization the malware sends hardware and OS information to the C2.
T1083 File and Directory Discovery Specific files are sought out and uploaded to the C2 Server.
TeamTNT is looking for misconfigured Docker API that allows access and code execution to everyone. They are often running malicious containers they host on Docker Hub or vanilla containers such as alpine:latest and add malicious commands.
If a successful login is achieved, a command is executed to download a setup shell script on the machine.
T1056 Input Capture The malware has Keylogging capabilities.
Keksec’s malware mainly uses Gafgyt and IRC protocols to send commands.
The IRC protocol is the most widely used protocol in Keksec, and is supported by the Tsunami, Necro and DarkIRC families.
We have observed many cases where the malicious payload contains code with message lookups causing outbound connections through various protocols, effectively creating a backdoor access for remote code execution.
There is also a 4th file ( muser ) that is designed to open a backdoor for the attackers
T1020 Automated Exfiltration The malware automatically and periodically uploads gathered information.
All this information is sent to the threat actor’s server via the wget command... The log files are uploaded every five minutes via a cron job... After the credentials had been dumped, they were exfiltrated to TeamTNT’s C2 server.
Downloading a Monero cryptominer and its configuration file and executing a cryptojacking attack.
T1496.001 Resource Hijacking: Compute Hijacking Multiple Cryptominers are deployed by the malware
Keksec is trying to make profit from DDoS, mining, stealing user information and selling malware. Through long-term tracking we can see that DDoS attack activity is the most prominent
Tsunami supports various DDoS attack commands... SYNFLOOD ... UDP Flood ... ShellBot supports ... udpflood, tcpflood, httpflood.
273 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
58 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.