Kaiji
Kaiji is a Linux-focused botnet malware family primarily used for distributed denial-of-service activity and, in some reporting, proxying malicious traffic. It targets Linux servers, IoT devices, and internet-exposed or misconfigured environments, including misconfigured Docker instances; it has also been observed delivered after exploitation of CVE-2025-55182 (React2Shell) and in campaigns exploiting vulnerable Apache2 web servers. Reported Kaiji capabilities include SYN, ACK, UDP, TCP, TLS, WebSocket, and raw-socket flood attacks, arbitrary shell command execution, encrypted or dynamic configuration handling, and in some variants embedded SOCKS5 and HTTP proxy functionality. Persistence and defense evasion are prominent: observed mechanisms include systemd services, SysV init scripts, cron/crontab entries, login/profile scripts, keep-alive scripts, replacement or modification of system utilities such as ls, ps, and netstat, process masquerading, bind-mount abuse to hide process artifacts, SELinux policy weakening, and hardware watchdog abuse to force reboots if the malware is terminated. Kaiji has also been reported deploying or embedding XMRig in some intrusions. The malware has been associated in reporting with Chinese-language artifacts or suspected Chinese-origin activity, though definitive attribution is not established. Multiple sources assess the Chaos botnet as an evolution of Kaiji based on code overlap and inherited routines. Notable infrastructure and indicators directly mentioned in the content include delivery via scripts such as wocaosinm.sh and download.sh, C2 or related domains su6s[.]su and else.su6s[.]su, download server 195.177.94.29:26154, C2 domain gmserver.osfc[.]org[.]cn in Chaos reporting tied to Kaiji lineage, attacker IP 45.12.1.19, and sample hashes including MD5 fd05b94c016fd2eb7e26c406fa2266d0 and SHA256 d0ef2f020082556884361914114429ed82611ef8de09d878431745ccd07c06d8.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
React2Shell in Russia: ... In some cases, the final payloads were the Kaiji and Rustobot botnets...
Santander’s security research team claims this threat actor is targeting security researchers by hiding a malicious backdoor in CVE-2024-6387 proof-of-concept code, and when running the PoC it will lead to infection of the server with Kaiji malware.
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
The script also establishes persistence by creating... a Cron task... If executed without root privileges... adds it to both crontab (via @reboot) and .bashrc... EtherRAT establishes persistence through... crontab.
The commands follow the same methodology: download a shell script, execute it via bash, and in some cases delete the script to remove evidence.
Persistence
6 techniques
Persistence
Kaiji establishes persistence via multiple mechanisms: systemd services, crontab tasks, init.d scripts, rc.local and profile.d modifications...
".../etc/init.d/dns-udp4 is also created. It is a SysV init script that ensures /boot/system.pub is executed automatically at system startup..."
The script also establishes persistence by creating... a Cron task... If executed without root privileges... adds it to both crontab (via @reboot) and .bashrc... EtherRAT establishes persistence through... crontab.
The script also establishes persistence by creating a systemd service /etc/systemd/system/apaches-main.service... If executed with root privileges... creates a systemd service... CrossC2 check.sh creates and starts a service... EtherRAT establishes persistence through: systemd.
KAIJI: A DDoS botnet capable of evading detection, setting up persistence, and altering SELinux policies. Its deployment involved moving system binaries, using bind mount techniques, and creating multiple backdoors for control.
"...drops and runs the file /etc/profile.d/gateway.sh ... overrides several common system commands: ps, ss, netstat, dir, ls, find, and lsof ... filters out..." | "Kaiji malware ... copies itself to /etc/profile.d/bash.cfg ... /etc/profile.d/bash.cfg.sh will run at login and execute /etc/profile.d/bash.cfg"
Privilege Escalation
6 techniques
Privilege Escalation
Kaiji establishes persistence via multiple mechanisms: systemd services, crontab tasks, init.d scripts, rc.local and profile.d modifications...
".../etc/init.d/dns-udp4 is also created. It is a SysV init script that ensures /boot/system.pub is executed automatically at system startup..."
The script also establishes persistence by creating... a Cron task... If executed without root privileges... adds it to both crontab (via @reboot) and .bashrc... EtherRAT establishes persistence through... crontab.
The script also establishes persistence by creating a systemd service /etc/systemd/system/apaches-main.service... If executed with root privileges... creates a systemd service... CrossC2 check.sh creates and starts a service... EtherRAT establishes persistence through: systemd.
KAIJI: A DDoS botnet capable of evading detection, setting up persistence, and altering SELinux policies. Its deployment involved moving system binaries, using bind mount techniques, and creating multiple backdoors for control.
"...drops and runs the file /etc/profile.d/gateway.sh ... overrides several common system commands: ps, ss, netstat, dir, ls, find, and lsof ... filters out..." | "Kaiji malware ... copies itself to /etc/profile.d/bash.cfg ... /etc/profile.d/bash.cfg.sh will run at login and execute /etc/profile.d/bash.cfg"
Stealth
4 techniques
Stealth
If executed with root privileges, copies the downloaded payload to /usr/bin/sshd-agent... Kaiji... masquerades as legitimate system libraries and configuration files (libgdi.so.0.8.1, opt.services.cfg, System.mod).
PeerBlight overwrites argv[0] in memory to hide its original path ... and replaces it with [ksoftirqd].
Credential Access
1 technique
Credential Access
Command and Control
4 techniques
Command and Control
C2 Tracker is a free-to-use-community-driven IOC feed that uses Shodan and Censys searches to collect IP addresses of known malware/botnet/C2 infrastructure.
"...C2 channels over HTTP/HTTPS and WebSocket (TLS-capable)... The domain su6s.su is used as the C2 server..."
"...an embedded SOCKS5 and HTTP proxy... proxy malicious traffic, leveraging compromised systems as part of a botnet."
This script downloaded the XMRig cryptocurrency miner... The attackers also loaded the d5.sh Bash script onto the compromised host to download the Sliver implant... The attackers employed the check.sh Bash script to download ELF executables (a_x86 / a_x64) from a server.
Impact
1 technique
Impact
IOCs tracked for this family
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet malware that targeted misconfigured Docker instances and is described as the precursor or evolutionary basis for Chaos.
DDoS malware/botnet known for targeting misconfigured Docker instances and assessed in the article as the predecessor or basis for Chaos.
Botnet malware believed to be an evolutionary predecessor of Chaos, from which Chaos inherited some exploitation routines.
Referenced as the botnet from which Chaos likely evolved based on code overlap.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.