Malware

Remaiten

Remaiten is a Linux malware family targeting embedded and IoT-class devices, particularly Linux-based routers and similar systems exposed with weak or default credentials. Identified in 2016, it is associated with botnet activity and is primarily used to compromise devices through brute-force authentication attempts against commonly used username and password combinations. Reporting has described it as affecting routers and potentially other Internet-connected embedded Linux devices.

Remaiten combines characteristics associated with the Tsunami and LizardStresser (Torlus) malware families. After gaining access, it attempts to determine the victim device architecture so it can retrieve a platform-appropriate payload, improving infection reliability across heterogeneous IoT hardware. Command-and-control communications use IRC, including actual IRC channels rather than merely an IRC-like protocol.

On compromised systems, Remaiten can participate in distributed denial-of-service operations, download additional malware, and scan memory or processes for competing bot malware. It has also been reported to remove rival bots from infected devices, indicating both botnet monetization and competitive control objectives. Its tradecraft and targeting place it among the notable Linux IoT bot malware families that proliferated through credential abuse rather than software exploitation alone.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078.001Default AccountsEvidence1

Remaiten is malware which infects Linux on embedded systems by brute forcing using frequently used default username and passwords combinations from a list in order to infect a system.

Persistence

1 technique

T1078.001Default AccountsEvidence1

Remaiten is malware which infects Linux on embedded systems by brute forcing using frequently used default username and passwords combinations from a list in order to infect a system.

Privilege Escalation

1 technique

T1078.001Default AccountsEvidence1

Remaiten is malware which infects Linux on embedded systems by brute forcing using frequently used default username and passwords combinations from a list in order to infect a system.

Stealth

3 techniques

T1070Indicator RemovalEvidence1

Remaiten is able to scan and remove competing bots on a system compromised by it.

T1078.001Default AccountsEvidence1

Remaiten is malware which infects Linux on embedded systems by brute forcing using frequently used default username and passwords combinations from a list in order to infect a system.

T1497.001System ChecksEvidence1

To avoid detection, Remaiten tries to determine the platform of a device to download the architecture-appropriate component from the command & control server.

Credential Access

1 technique

T1110Brute ForceEvidence2

Infected IoT devices constantly scan the Web for other IoT things to compromise, wriggling into devices that are protected by little more than insecure factory-default settings and passwords.

Discovery

4 techniques

T1046Network Service DiscoveryEvidence1

The infected devices constantly scan the Web for other IoT things to compromise... CJ: I scanned the internet with a few sets of defualt logins for telnet

T1057Process DiscoveryEvidence1

Continuously scans /proc/ for new processes... For each process: Checks if the binary's realpath contains .anime... Performs memory scanning of /proc/$pid/exe against signatures for known competing botnets...

T1497.001System ChecksEvidence1

To avoid detection, Remaiten tries to determine the platform of a device to download the architecture-appropriate component from the command & control server.

T1518Software DiscoveryEvidence1

Performs memory scanning of /proc/$pid/exe against signatures for known competing botnets: QBOT/Bashlite variants... UPX-packed binaries... Zollard worm... Remaiten...

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence1

The command and control for Remaiten are handled by IRC communications. Additionally the command and control is done by an actual IRC channel rather than only the IRC protocol.

T1105Ingress Tool TransferEvidence1

To avoid detection, Remaiten tries to determine the platform of a device to download the architecture-appropriate component from the command & control server.

Impact

3 techniques

T1489Service StopEvidence1

issues kill(pid, 9)... unlink() the binary and kill -9 the process... This targets malware that deletes itself after execution...

T1496Resource HijackingEvidence1

Mirai , a malware strain that enslaves poorly secured Internet of Things (IoT) devices like wireless routers and security cameras into a botnet for use in large cyberattacks.

T1498Network Denial of ServiceEvidence2

These so-called “ distributed denial-of-service ( DDoS) attacks are digital sieges in which an attacker causes thousands of hacked systems to hit a target with so much junk traffic that it falls over and remains unreachable by legitimate visitors.

Other

1 technique

T1562Impair DefensesEvidence1

add_entry(TABLE_KILLER_PROC, ...); add_entry(TABLE_MEM_QBOT, ...); add_entry(TABLE_MEM_ZOLLARD, ...); add_entry(TABLE_MEM_REMAITEN, ...);

ACTIVITY FEED

Recent activity

7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

7 SOURCESView more in app

breakglass intelNews

Mar 7, 2026

Anatomy of a Mirai Variant: Full Source Code Recovery of an IoT Botnet - Breakglass Intelligence - Breakglass Intelligence

Remaiten is referenced as a competing Linux ELF botnet malware family that this Mirai variant attempts to detect and kill on infected devices.

wikipedia cyber incidentsNews

Feb 26, 2018

BrickerBot - Wikipedia

Notable IoT malware BASHLITE BrickerBot Carna Hajime Linux.Darlloz Linux.Wifatch Mirai Remaiten

wikipedia enNews

Nov 6, 2016

Remaiten - Wikipedia

Linux malware targeting embedded systems and IoT devices, especially routers, by brute-forcing default credentials. It uses IRC-based command and control, can launch distributed denial-of-service attacks, download additional malware, determine device architecture to fetch appropriate components, and remove competing bots from infected systems.

wikipedia enNews

Oct 19, 2016

BASHLITE - Wikipedia

Notable IoT malware BASHLITE BrickerBot Carna Hajime Linux.Darlloz Linux.Wifatch Mirai Remaiten

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Remaiten