Loading malware…
KATARU is a Mirai-like IoT botnet malware family targeting poorly secured Linux-based embedded devices. It has been observed obtaining access through Telnet credential brute forcing, after which an ARM payload is retrieved and executed using BusyBox utilities. The malware supports command-and-control-directed DDoS floods using TCP, UDP, ICMP, HTTP, QUIC, DNS, and application-specific routines targeting services such as Minecraft, FiveM, OpenVPN, and WireGuard.
KATARU uses encrypted command-and-control based on X25519 key exchange and ChaCha20-Poly1305. Operators can task infected devices to execute shell commands, download and run additional binaries, conduct SSH credential brute forcing, stop active floods, and remove malware components. It attempts local privilege escalation by modifying writable password data, invoking public Linux local privilege-escalation exploit code associated with CVE-2026-46300, CVE-2026-43284, and CVE-2026-31431, and attempting a cgroup v1 release-agent escape. Some embedded privilege-escalation code is architecture mismatched in analyzed ARM builds, limiting confidence in its operational effectiveness.
The family implements broad persistence logic across Linux and embedded environments, including systemd, cron, init scripts, OpenWrt mechanisms, package-management hooks, and boot-related locations. It also includes Android-oriented boot persistence attempts. When permissions permit, it may attempt to make copied components immutable or append-only. Anti-analysis and defense-evasion features include debugger and tracing checks, environment and process checks, timing checks, encrypted C2, self-removal, and decoy web-like, IRC-like, TCP, and UDP traffic. No named threat actor attribution is established.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
“KATARU tries to persist through ... cron tasks.”
“[KATARU] can ... run commands supplied by its operators” and “execute shell commands.”
T1106 – Native API: Raw syscall wrapper, raw sockets, and ioctl for file-attribute changes.
The sample then attempts a broad persistence sweep across common Linux and embedded startup paths... rc.local, SysV init, and inittab... OpenWrt procd and hotplug scripts; alternative init systems such as runit, s6, dinit, and OpenRC.
“KATARU tries to persist through ... cron tasks.”
“Once running, it checks whether /etc/passwd is writable and tries to remove the root password placeholder.”
“KATARU tries to persist through systemd services.”
The malware attempts persistence through udev, APT, OPKG, NetworkManager, and DHCP hooks; OpenWrt procd and hotplug scripts; and Android init services triggered by sys.boot_completed or dev.bootcomplete.
“KATARU tries to persist through ... rc scripts, OpenWrt hooks, package-management hooks, and Android boot locations.”
“[It] checks whether /etc/passwd is writable and tries to remove the root password placeholder.”
The sample then attempts a broad persistence sweep across common Linux and embedded startup paths... rc.local, SysV init, and inittab... OpenWrt procd and hotplug scripts; alternative init systems such as runit, s6, dinit, and OpenRC.
“KATARU tries to persist through ... cron tasks.”
“It then attempts public code for CVE-2026-46300 ... CVE-2026-43284 ... and CVE-2026-31431 ... [and] a cgroup v1 release_agent escape that can relaunch the malware with higher privileges.”
“Once running, it checks whether /etc/passwd is writable and tries to remove the root password placeholder.”
“KATARU tries to persist through systemd services.”
The malware attempts persistence through udev, APT, OPKG, NetworkManager, and DHCP hooks; OpenWrt procd and hotplug scripts; and Android init services triggered by sys.boot_completed or dev.bootcomplete.
“KATARU tries to persist through ... rc scripts, OpenWrt hooks, package-management hooks, and Android boot locations.”
Escape cgroup v1 via release_agent (/sys/fs/cgroup/memory/release_agent).
Nom de famille basé sur le nonce ChaCha20 utilisé pour déchiffrer la configuration.
“It can ... stop active floods, and remove its files.”
Timing check: the sample computes the time delta between the execution of a short loop and terminates if it is larger than expected (~100ms), which indicates single-stepping or heavy instrumentation.
The sample calls ptrace with PTRACE_TRACEME... checks /proc/self/status for TracerPid... exits early if it detects LD_PRELOAD... checks for radare2 or Valgrind-related indicators... and terminates if debugger or reverse-engineering process names are found.
Copie dans plusieurs emplacements ; utilisation de CAP_LINUX_IMMUTABLE pour rendre les copies immuables.
“It may mark copies immutable or append-only when permissions allow.”
“[It] checks whether /etc/passwd is writable and tries to remove the root password placeholder.”
Fonctionnalités : botnet style Mirai, communications C2 chiffrées, anti-analyse, trafic leurre.
“KATARU begins with Telnet credential brute forcing” and supports command-server-directed “SSH” brute forcing.
“[It] checks whether /etc/passwd is writable and tries to remove the root password placeholder.”
T1016 – System Network Configuration Discovery: Reads /proc/net/*, resolv.conf, and the local IP.
T1082 – System Information Discovery: Reads uname, /proc/cpuinfo, disk, and information about page count and page sizes.
“Once running, it checks whether /etc/passwd is writable.”
Timing check: the sample computes the time delta between the execution of a short loop and terminates if it is larger than expected (~100ms), which indicates single-stepping or heavy instrumentation.
The sample calls ptrace with PTRACE_TRACEME... checks /proc/self/status for TracerPid... exits early if it detects LD_PRELOAD... checks for radare2 or Valgrind-related indicators... and terminates if debugger or reverse-engineering process names are found.
Fonctionnalités : botnet style Mirai, communications C2 chiffrées, anti-analyse, trafic leurre.
T1095 – Non-Application Layer Protocol: Custom length-prefixed binary protocol over TCP (port 6767).
“KATARU begins with Telnet credential brute forcing, then uses BusyBox commands to retrieve and execute a payload.” It can also “download additional binaries through wget.”
“Each device creates an X25519 key pair and uses a shared secret to protect commands with ChaCha20-Poly1305 encryption.”
“Each device creates an X25519 key pair and uses a shared secret to protect commands with ChaCha20-Poly1305 encryption.”
“The malware supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods.”
“The malware supports TCP, UDP, ICMP, HTTP, QUIC, and DNS floods,” including attacks against Minecraft, FiveM, OpenVPN, and WireGuard.
It also includes attack types tailored to specific services, such as Minecraft, FiveM, OpenVPN, and WireGuard... T1499.002 – Service Exhaustion Flood: HTTP, HTTP/2, QUIC, and game-server floods.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.