Hakai

Hakai is an IoT botnet malware family built on Gafgyt/Bashlite code and used to compromise embedded Linux devices such as routers and other internet-connected appliances. It has been observed in campaigns that combined numerous publicly known exploits against vulnerable edge and consumer devices, including routers, DVRs, NVRs, IP cameras, and similar embedded systems. Earlier Hakai samples used a broad exploit set derived from contemporaneous Mirai- and Gafgyt-based campaigns, and later samples added exploitation of D-Link DSL-2750B command-injection exposure shortly after public exploit tooling became available.

Hakai is associated with botnet operations focused on distributed denial-of-service activity. As a Gafgyt-derived family, it is designed to enroll compromised devices into a remotely controlled botnet and execute attack commands issued by operators. Reporting also links Hakai to delivery via droppers used by updated Bashlite activity, indicating overlap in tooling and ecosystem between closely related IoT malware operations.

The malware targets Linux-based embedded platforms and router-class devices exposed to the internet. Observed campaigns relied on exploit-based propagation, and related Bashlite-linked activity tied to Hakai delivery also used Telnet scanning and credential brute forcing against IoT devices. Hakai fits the broader pattern of opportunistic mass exploitation of poorly secured embedded systems for botnet growth and DDoS operations.