Loading story…
ESET reported that Linux/Rakos is compromising internet-exposed embedded devices and Linux servers by brute-forcing weak or default SSH credentials, then enrolling the systems into a botnet. The malware, written in Go and often packed with UPX, hides under names such as .javaxxx, .swap, and kworker, starts local and external HTTP services, sends host details and stolen credentials to command-and-control servers, retrieves target IP lists, and propagates by uploading itself to newly accessed hosts. Researchers said the operators can remotely update configuration files and upgrade the malware, while analyzed samples showed no built-in DDoS or spam module.
The activity mirrors earlier Linux botnet campaigns such as Linux/Moose, which also spread by abusing weak default credentials on embedded Linux devices rather than exploiting software flaws. Moose primarily brute-forced Telnet on consumer routers and other MIPS and ARM systems, then used infected devices as whitelisted SOCKS/HTTP proxies, sniffed unencrypted traffic for social-network cookies, and supported large-scale social-media fraud from residential IP space. Both malware families lack reliable persistence after reboot, but exposed devices can be quickly reinfected if default passwords remain unchanged, including after factory resets.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
ESET researchers Peter Kálnai and Michal Malik published analysis of Linux/Rakos, describing its SSH brute-force propagation, C2 communications, credential theft, and reinfection risk on rebooted or factory-reset devices. ESET also released indicators of compromise, malware hashes, C2 server addresses, and a Volatility plugin for detection and memory analysis.
ESET documented Linux/Rakos malware samples for multiple architectures, including x86_64, MIPS, and 386, with first-seen dates spanning August through December 2016. The samples showed a botnet-focused malware family spreading through brute-force SSH attacks on devices and servers with weak credentials.
ESET published analysis of Linux/Moose, a Linux worm targeting consumer routers and embedded devices via brute-forced Telnet credentials, and concluded its primary purpose was social-network fraud using infected devices as proxies. The report documented capabilities including NAT traversal, traffic sniffing for social-network cookies, DNS hijacking during infection, and lateral scanning.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 38 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourcewelivesecurity.com
Open sourceweb-assets.esetstatic.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**XOR.DDoS** has been used to compromise Linux servers through SSH brute-force attacks, install a malicious ELF payload, and turn infected hosts into botnet nodes for distributed denial-of-service activity. Reporting shows the malware can launch **SYN flood, ACK flood, and DNS amplification** attacks, while maintaining command-and-control communications through a custom protocol and a hard-coded XOR key. Investigations also linked some intrusions to deployment of a second payload, **Groundhog**, a backdoor that provides reverse shell access, file download capability, configuration updates, and persistent remote control, suggesting both tools were operated as related modules in the same campaign. The malware is notable for its stealth and persistence on Linux systems. It can tailor installation to the victim's kernel, deploy or build a **loadable kernel module rootkit** to hide processes and TCP ports, and survive reboots through files and scripts placed in `/boot`, `/etc/init.d`, cron, and other system paths. Researchers also observed the malware killing competing processes, reinstalling itself under deceptive filenames, and in some cases being followed by additional payloads such as the **Tsunami** backdoor and **XMRig** miner. Microsoft reported a sharp rise in XorDdos activity, underscoring continued risk to internet-exposed Linux devices with weak SSH credentials.
Aug 15, 2026
Internet Storm Center (ISC) researchers reported a **self-propagating SSH worm** observed by a DShield honeypot sensor that can compromise exposed Linux systems in roughly **four seconds** by using **credential stuffing/brute force** against weak SSH passwords, with a notable focus on *Raspberry Pi* devices left on default or common credentials (e.g., user `pi` with passwords such as `raspberry` and `raspberryraspberry993311`). The observed attack chain rapidly authenticates, uploads a compact **4.7 KB bash script** (via SCP), executes it, and establishes persistence while removing competing malware, enabling worm-like exponential spread across vulnerable internet-connected hosts. Technical analysis indicates the activity likely originated from an already-compromised *Raspberry Pi* in Germany (IP `83.135.10.12`, Versatel Deutschland), using an SSH client string consistent with Raspbian (`SSH-2.0-OpenSSH_8.4p1 Raspbian-5+b1`) and a recorded HASSH fingerprint `ae8bd7dd09970555aa4c6ed22adbbf56`. Post-compromise, the malware connects to **IRC-based command-and-control** and includes **cryptographically signed command verification**; it also automates scanning and lateral movement using tools such as **Zmap** and **sshpass**, reinforcing how default/weak SSH authentication on IoT and small-form-factor Linux systems remains a high-impact botnet entry point.
Jun 29, 2026
Researchers detailed how the **Linux/Moose** botnet compromised Linux-based routers and embedded IoT devices, then used those systems as proxy nodes to run large-scale social media fraud. The malware primarily abused weak or default credentials rather than a software exploit, infected devices from vendors including **Actiontec, Hik Vision, Netgear, Synology, TP-Link, ZyXEL, and Zhone**, and automated actions such as creating fake accounts, following users, liking posts, and viewing videos while staggering activity to mimic human behavior. Analysis indicated Instagram was a major target, and the malware also removed competing malware from infected routers and scanned for additional devices to compromise. A broader investigation linked Linux/Moose to the commercial supply chain behind fake likes and followers, highlighting bulk reseller panels and software panel sellers as key enablers of the fraud ecosystem. Researchers found a whitelist of seven IP addresses in the malware that likely supported centralized fake-account management, suggesting coordination by the same actor rather than unrelated resellers. The reports said customer-facing sellers likely captured the highest margins, while upstream panel operators depended on bulk volume, and warned that infected routers could also be repurposed for **DDoS**, network reconnaissance, eavesdropping, and **DNS hijacking** beyond social-media manipulation.
Aug 15, 2026