KATARU IoT Botnet Uses Public Privilege-Escalation Exploits and Encrypted C2

Researchers observed the Mirai-style KATARU IoT malware compromising a honeypot through Telnet credential brute forcing before downloading and executing an ARM payload. The malware supports DDoS floods, SSH brute forcing, secondary-payload delivery, arbitrary shell commands, self-removal, anti-analysis checks, and a broad set of Linux, embedded-device, and Android persistence techniques. It also attempts multiple public local privilege-escalation exploits, including some mismatched to the victim architecture.

KATARU uses custom encrypted command-and-control communications incorporating RFC 7748 Curve25519/X25519-related test-vector values, apparently as decoy or rapidly reused public code. Researchers assess its noisy, cross-platform persistence and unvalidated exploit logic suggest fast assembly rather than a mature operation. Organizations should disable or tightly restrict Telnet, replace weak device credentials, patch supported firmware and Linux kernels, segment IoT and OT networks, and investigate startup-file or immutable-attribute changes and unusual encrypted outbound or flood-like traffic.