Loading malware…
kitty is a DDoS-focused botnet malware variant that emerged in October 2024 as an evolution of the AISURU botnet. It was observed after AISURU activity temporarily subsided and appears to represent an intermediate stage before the later AIRASHI variant. The malware is associated with large-scale distributed denial-of-service operations and includes command-and-control functionality for attack management as well as reverse shell access and arbitrary command execution features consistent with broader post-compromise botnet control.
kitty spread in early October 2024 and was reported in the context of exploitation of exposed systems and devices. It has also been associated with exploitation of CVE-2018-7600 in Drupal. Technically, kitty differed from earlier AISURU samples by using a simplified network protocol. Later samples communicated with command-and-control infrastructure through SOCKS5 proxies, removed the original key-exchange process, and transmitted traffic without encryption. Reported command support included starting and stopping attacks, terminating execution, and invoking reverse shell functionality.
The malware is tied to globally distributed botnet activity rather than a narrowly defined victim sector. It is linked to campaigns involving high-volume DDoS attacks, including activity targeting gaming-related infrastructure. Available reporting supports classifying kitty primarily as a botnet malware family with DDoS and post-exploitation capabilities on compromised systems. Separate reporting mentioning KiTTY as a weaponized PuTTY fork used by Lazarus refers to a distinct tool and should not be conflated with this lowercase kitty botnet variant.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2018-7600 Vulnerable Products: Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 Associated Malware: Kitty Mitigation: Upgrade to the most recent version of Drupal 7 or 8 core. | CVE-2018-7600 ... Associated Malware: Kitty
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Lazarus recent development of KiTTY, a weaponized PuTTY fork, as part of its BLINDINGCAN infection chain
10 distinct techniques documented for this family, organized by ATT&CK tactic.
An arbitrary code execution vulnerability in Citrix VPN appliances, known as CVE-2019-19781, has been detected in exploits in the wild. An arbitrary file reading vulnerability in Pulse Secure VPN servers, known as CVE-2019-11510, continues to be an attractive target for malicious actors.
添加了反向shell的功能……AIRASHI-DDoS: 最早发现于10月底,功能以DDoS为主,也可执行任意指令、获取反向shell
“The command types still focus primarily on DDoS, with the addition of a reverse shell functionality… cmdtype 0x13 reverse shell… AIRASHI-DDoS… allows arbitrary command execution and reverse shell access… MSG_Type… 12 Reverse Shell.”
U.S. Government reporting has identified the top 10 most exploited vulnerabilities by state, nonstate, and unattributed cyber actors from 2016 to 2019 as follows: CVE-2017-11882, CVE-2017-0199, CVE-2017-5638, CVE-2012-0158, CVE-2019-0604, CVE-2017-0143, CVE-2018-4878, CVE-2017-8759, CVE-2015-1641, and CVE-2018-7600.
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A streamlined AISURU variant used for DDoS operations that later added SOCKS5 proxy-based C2 communications and reverse shell capability. It uses simplified plaintext communications with heartbeat messages and encoded proxy/C2 entries.
Variant in the AISURU/AIRASHI lineage observed spreading in early October 2024. Implements DDoS and OS command execution; later versions add SOCKS5 proxying (with authentication) to reach C2, embed large proxy/C2 lists, and include reverse shell capability. Uses XOR-based string decoding with a modified key; later samples simplify/disable traffic encryption and use distinctive heartbeat/startup strings (e.g., 'Kitty-Kitty-Kitty', 'cat'/'meow!').
Weaponized PuTTY fork used by Lazarus as part of the BLINDINGCAN infection chain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.