Loading malware…
Potassium is a Mirai-derived distributed denial-of-service botnet first publicly identified in March 2026. It targets Linux-based systems and internet-of-things devices, with observed Android delivery through Android Debug Bridge. Builds support multiple processor architectures, including ARM, MIPS, and x86. Campaigns tracked as vitacoco, iambig, and botlesscucks share substantial code, cryptographic material, and command-and-control protocol characteristics. No named threat actor has been conclusively attributed to the family.
Potassium supports UDP, TCP, ICMP, GRE, and HTTP flooding, together with attacks tailored to gaming services such as Minecraft and FiveM. Some builds provide reverse-shell or interactive terminal access, additional executable downloading, process termination, source-address spoofing, and self-replacement. Observed DDoS targets include gaming infrastructure, web services, and DNS services. The malware conceals configuration strings using ChaCha20, disguises its processes as legitimate services, and obscures command-and-control destinations by transforming DNS-returned IPv4 addresses before connecting. Communication protection varies across builds, from static XOR encoding to authenticated encryption in newer samples. Embedded public DNS resolvers provide fallback name resolution. An analyzed self-update mechanism retrieves replacement executables without signature verification.
In October 2026, attackers attempted to deploy Potassium through PHP2Shell, the PHP remote-code-execution vulnerabilities CVE-2026-109618 and CVE-2026-109619, extending targeting to exposed web servers. Sophos blocked the attempt it analyzed and found no evidence of successful compromise in its customer telemetry; Arctic Wolf likewise did not establish that the associated requests downloaded or executed Potassium. These attempted deployments do not establish successful infection through PHP2Shell. Persistence and autonomous propagation are build-dependent: an analyzed October sample had no observed persistence, autonomous scanning, or password-guessing mechanism.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The most commonly abused trigger is a multipart POST carrying a PHP_SESSION_UPLOAD_PROGRESS field, which works against the default configuration.
"SHOUT reverse shell... lets the operator run /bin/sh -c <anything> on infected devices" using "execl('/bin/sh', 'sh', '-c', cmd, NULL)".
a vulnerable proxy SDK is itself an initial-access vector: a customer who tunnels to a node's own 0.0.0.0:5555 reaches the exit device's ADB daemon and recruits it into whatever the operator is building, DDoS botnets included
"The static config table uses IETF ChaCha20 with a key and nonce embedded in the .data section" and contains 222 encrypted entries.
"renames itself via /proc/self/comm to dvrLocker or dvrInside" and outputs "Segmentation fault (core dumped)" on startup.
"Watchdog disable: accesses /dev/watchdog and /dev/misc/watchdog to prevent hardware watchdog resets."
"Mirai-style telnet scanner" and detection guidance identifies "SYN packets to port 23/TCP (the telnet scanner)."
"Competitor killer: scans /proc/*/maps for byte patterns from rival Mirai-family binaries and sends SIGKILL to any match."
"The bot swaps the two 16-bit halves of the resolved address before connecting. The actual C2 IP is never the one in DNS."
"Three of [the std_flood payload templates] mimic authenticated web traffic with token=<40-hex>&guid=<24-hex> strings" to make mitigation fingerprinters process the traffic.
"The C2 protocol is raw TCP with 0xED XOR, not HTTP" and uses a select-based TCP event loop.
As Synthient documented, a vulnerable proxy SDK is itself an initial-access vector: a customer who tunnels to a node's own 0.0.0.0:5555 reaches the exit device's ADB daemon and recruits it into whatever the operator is building, DDoS botnets included.
"All C2 wire traffic, including registration, attack commands, info-query responses, and SHOUT responses, uses a single static XOR byte."
"sends SIGKILL to any [rival Mirai-family binary] match" and "kills reboot, shutdown, halt, and poweroff processes."
"Potassium is a Mirai-derived DDoS botnet" and active C2 monitoring logged roughly 300 attack commands per day.
28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.