Loading story…
Researchers at CrySyS Lab presented EMBeD (Embedded Malware Benchmark Dataset), a proposed public benchmark intended to make IoT malware-binary detection research more reproducible and comparable. The dataset addresses reliance on proprietary collections, inconsistent malware-family labels, and undisclosed machine-learning training and test splits by providing balanced, consistently labeled samples.
EMBeD extracts sample metadata, filters unreliable binaries, and derives and validates family labels using weighted VirusTotal detections and TLSH-based similarity graphs. Its proof of concept processed 67,800 MIPS IoT-malware samples and produced seven families—Mirai, Gafgyt, Hajime, Kaiji, Tsunami, DDoSTF, and Dofloo—with 100 samples per family; planned releases will expand coverage and add architectures including ARM using sources such as VirusTotal and Ukatemi's Kaibou Repo.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Dávid Maliga, Dorottya Papp, and Levente Buttyán presented EMBeD, a proposed public benchmark for IoT malware-binary detection research, at the 2026 IEEE Conference on Information Technology and Data Science in Debrecen. The proof of concept curated 67,800 MIPS IoT-malware samples into balanced sets of 100 samples for each of seven families: Mirai, Gafgyt, Hajime, Kaiji, Tsunami, DDoSTF, and Dofloo.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **P2PInfect** worm, a Rust-based cross-platform malware family, expanded beyond earlier `x86-64` infections to target **ARM** and **MIPS** systems, increasing the threat to IoT and embedded Linux environments. The worm spreads through multiple paths, including exploitation of **Redis** weaknesses and **SSH** brute-force activity, and uses a **peer-to-peer** architecture rather than a centralized command-and-control server, making disruption more difficult. Analysis of newer samples showed the malware also incorporates self-protection and evasion features, including anti-debugging checks, disabled core dumps, runtime modification of a dropped auxiliary binary, and wrapper ELF files used to conceal the main payload. Telemetry tied the campaign to growing infection activity from late 2023 into early 2024, with observed malicious connections frequently originating from **China, Hong Kong, and Singapore**, while published research also included detection content such as **YARA rules**, infrastructure indicators, and malware hashes to support defender response.
Aug 15, 2026
Researchers reported new destructive malware targeting embedded and IoT devices, including a newly identified **Kaden** botnet and a new **LOLFME** variant tied to the **KekSec** ecosystem, while **AcidPour** surfaced as a new embedded wiper variant of **AcidRain** in Ukraine. The findings point to continued evolution of Linux-based malware capable of disrupting routers, modems, and other edge devices that are often used in critical infrastructure environments. Forescout said Kaden blends code from **rebirth**, **Gafgyt**, **Mirai** variants, and **Silex**, and contains a wiping function that is present but not yet connected to an active C2 command. The newer LOLFME sample appears more mature, with logic to wipe a device if it loses contact with its command server and a **`bricklol`** capability designed to destroy logs, storage, and networking before rebooting the host. Researchers used YARA hunting based on earlier IoT wipers including **AcidRain**, **AcidPour**, **BrickerBot**, **HEH**, **VPNFilter**, **Silex**, and **HandyMannyPot**, and said there is not yet confirmed evidence that the Kaden or LOLFME wipers have been deployed at scale in the wild.
Aug 14, 2026
Researchers reported that multiple **Gafgyt/Bashlite** variants targeting IoT devices are reusing leaked **Mirai** source code while continuing to evolve their infection and attack capabilities. Analyses found shared modules for **HTTP, UDP, and TCP flooding**, a telnet brute-force scanner, and other botnet functions, alongside exploitation of known router flaws including `CVE-2017-17215`, `CVE-2014-8361`, and `CVE-2018-10561`. Separate reporting also described campaigns abusing exposed **SSH**, **Telnet**, and **WeMo UPnP** services to drop first-stage shell scripts and architecture-specific ELF payloads that conscript devices into distributed denial-of-service operations. Recent samples show operators tailoring payloads for stealth and persistence after compromise. One analyzed ELF binary, packed with **UPX** and masquerading as `/usr/bin/apt`, was observed beaconing to `45.61.186.4:13561`, killing rival malware, flushing `iptables`, stopping local firewall services, clearing shell history, and altering DNS settings before accepting commands for **TCP, UDP, GRE, ICMP, HTTP, and game-server-focused floods**. Other reports noted process renaming, heavy forking, changing filenames and infrastructure, and added backdoor or cryptomining functions, indicating that Gafgyt operators are using modular, frequently modified malware to evade detection and sustain IoT-focused DDoS campaigns.
Aug 15, 2026