TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
20:43 · July 15, 2026 · Hacker News AI Section
Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model (LLM), albeit with not so successful results. "While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed
Summary
Cybersecurity researchers at Palo Alto Networks Unit 42 have identified TuxBot v3 Evolution, an unreported IoT botnet framework whose code contains clear traces of large-language-model assistance. The developer prompted an LLM to generate botnet components, yet left both a safety disclaimer and raw chain-of-thought comments in the shipped files; these comments preserve the model’s step-by-step reasoning, self-corrections, and references to “the user” during porting tasks.
The framework comprises a C-based bot agent that cross-compiles for ARM, MIPS, x86_64, PowerPC, RISC-V and other architectures, a Go-based command-and-control server that includes a multi-user DDoS-for-hire panel, a custom exploit virtual machine, Docker-based test infrastructure, and an automated build pipeline. The agent attempts Telnet brute-force attacks using 1,496 credential pairs and ships exploit code aimed at more than thirty IoT device families. It supports encrypted TCP channels to the C2, a SHA-512 domain-generation algorithm, Ed25519-signed peer-to-peer gossip, IRC, DNS TXT queries, and HTTP polling as fallback mechanisms.
Although several functions are non-functional, the modular design draws from Mirai, AISURU, Wuhan and the open-source MHDDoS toolkit. At least one sample reached VirusTotal in January 2026, and repository activity indicates development began roughly a year earlier. Shared infrastructure links the operator to the Keksec group, which maintains multiple IoT botnet variants in parallel. The episode illustrates how a single actor can leverage an LLM to assemble a multi-channel C2, exploit delivery system, and attack panel more rapidly than manual coding alone would allow, even when the resulting code still requires manual debugging.
Why it matters
This article provides concrete evidence of threat actors utilizing LLMs to accelerate malware development, a critical trend for security professionals to track. Understanding these AI-assisted capabilities is essential for Dutch cybersecurity teams to update threat models and defend against increasingly sophisticated attacks on IoT infrastructure.
