Loading story…
ESET detailed Linux/Shishiga, a Lua-based malware family targeting GNU/Linux systems across IoT-focused architectures including MIPS, ARM, i686, and PowerPC. The malware spreads by brute-forcing weak Telnet and SSH credentials and differs from many Linux worms by combining BitTorrent, SSH, Telnet, and HTTP for propagation and command-and-control activity. Researchers said the malware is packed with UPX, statically linked with the Lua runtime, and can deploy a main loader with the .lm extension alongside a backdoor with the .dm extension that listens on TCP port 2015.
Shishiga’s modules support credential theft, architecture detection, persistence, scanning, file upload, and retrieval of updates and scripts through BitTorrent-delivered .bt files. Infected systems may also expose an HTTP service on port 8888, with the unusual response HTTP/1.0 404 OK on the root path serving as an indicator of compromise. ESET identified 93.117.137.35 as a command-and-control server, while Censys found roughly 10 Internet-facing IPs matching the malware’s HTTP fingerprint, indicating a limited but active infection set and a malware project still under active development.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ESET identified the malware's command-and-control server as 93.117.137.35, and Censys found about 10 Internet-facing IP addresses matching Shishiga's distinctive HTTP fingerprint. This indicated a limited but active set of infected hosts at the time of analysis.
ESET analyzed a newly identified Lua-based malware family targeting GNU/Linux systems and named it Linux/Shishiga. The malware spreads by brute-forcing weak Telnet and SSH credentials, uses BitTorrent alongside SSH, Telnet, and HTTP, and targets architectures common in IoT devices.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 37 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that multiple **Gafgyt/Bashlite** variants targeting IoT devices are reusing leaked **Mirai** source code while continuing to evolve their infection and attack capabilities. Analyses found shared modules for **HTTP, UDP, and TCP flooding**, a telnet brute-force scanner, and other botnet functions, alongside exploitation of known router flaws including `CVE-2017-17215`, `CVE-2014-8361`, and `CVE-2018-10561`. Separate reporting also described campaigns abusing exposed **SSH**, **Telnet**, and **WeMo UPnP** services to drop first-stage shell scripts and architecture-specific ELF payloads that conscript devices into distributed denial-of-service operations. Recent samples show operators tailoring payloads for stealth and persistence after compromise. One analyzed ELF binary, packed with **UPX** and masquerading as `/usr/bin/apt`, was observed beaconing to `45.61.186.4:13561`, killing rival malware, flushing `iptables`, stopping local firewall services, clearing shell history, and altering DNS settings before accepting commands for **TCP, UDP, GRE, ICMP, HTTP, and game-server-focused floods**. Other reports noted process renaming, heavy forking, changing filenames and infrastructure, and added backdoor or cryptomining functions, indicating that Gafgyt operators are using modular, frequently modified malware to evade detection and sustain IoT-focused DDoS campaigns.
Aug 15, 2026
Researchers reported that the **P2PInfect** worm, a Rust-based cross-platform malware family, expanded beyond earlier `x86-64` infections to target **ARM** and **MIPS** systems, increasing the threat to IoT and embedded Linux environments. The worm spreads through multiple paths, including exploitation of **Redis** weaknesses and **SSH** brute-force activity, and uses a **peer-to-peer** architecture rather than a centralized command-and-control server, making disruption more difficult. Analysis of newer samples showed the malware also incorporates self-protection and evasion features, including anti-debugging checks, disabled core dumps, runtime modification of a dropped auxiliary binary, and wrapper ELF files used to conceal the main payload. Telemetry tied the campaign to growing infection activity from late 2023 into early 2024, with observed malicious connections frequently originating from **China, Hong Kong, and Singapore**, while published research also included detection content such as **YARA rules**, infrastructure indicators, and malware hashes to support defender response.
Aug 15, 2026
ESET reported that **Linux/Rakos** is compromising internet-exposed embedded devices and Linux servers by brute-forcing weak or default **SSH** credentials, then enrolling the systems into a botnet. The malware, written in **Go** and often packed with **UPX**, hides under names such as `.javaxxx`, `.swap`, and `kworker`, starts local and external HTTP services, sends host details and stolen credentials to command-and-control servers, retrieves target IP lists, and propagates by uploading itself to newly accessed hosts. Researchers said the operators can remotely update configuration files and upgrade the malware, while analyzed samples showed no built-in DDoS or spam module. The activity mirrors earlier Linux botnet campaigns such as **Linux/Moose**, which also spread by abusing weak default credentials on embedded Linux devices rather than exploiting software flaws. Moose primarily brute-forced **Telnet** on consumer routers and other MIPS and ARM systems, then used infected devices as whitelisted SOCKS/HTTP proxies, sniffed unencrypted traffic for social-network cookies, and supported large-scale social-media fraud from residential IP space. Both malware families lack reliable persistence after reboot, but exposed devices can be quickly reinfected if default passwords remain unchanged, including after factory resets.
Aug 14, 2026