Nozomi Networks Labs avval hujjatlashtirilmagan, Go tilida yozilgan Linux uchun DDoS bot — Kairosni hujjatlashtirdi. U buzilgan Linux qurilmalarini hujum tugunlariga aylantirib, minglab bekor TCP sessiyalari bilan jabrlanuvchining ulanish sig'imini tugatadi.
Honeypot telemetriyasi uchta Kairos qurilishini qo'lga kiritdi. Ular faqat qattiq kodlangan C2 manzili va Go kompilyator patch darajasi (1.27.0 va 1.27.1) bilan farq qiladi, bu esa C2 bo'yicha qurilish tarqatish modelini ko'rsatadi.
Nozomi Networks Labs tomonidan chop etilgan texnik tahlilga ko'ra, hujumchilar Telnet orqali kirishgan, bunda standart root foydalanuvchisi va bo'sh parol ishlatilgan. Tengu Linux botiga o'xshab, operator keyin /tmp dan shell ketma-ketligini bajargan.
Ketma-ketlik arxitekturaga mos keladigan yukni wget, curl, BusyBox wget va TFTP bilan navbat bilan yuklab olgan, har bir nusxada chmod 777 va fon rejimida bajarish ishlatilgan. Namuna zanjirida 172[.]86[.]85[.]39 yukni TCP/8080 da joylashtirgan va C2 sifatida TCP/9999 da ishlagan.
Bot qattiq kodlangan bitta IPv4 manzilga TCP/9999 orqali ulanadi va oddiy matnli beacon yuboradi: REGISTER linux amd64 . Har ikki soniyada keepalive yangi qatori yuboriladi. Agar sessiya uzilsa, bot har besh soniyada qayta ulanishga urinadi, bunda jitter yoki qayta urinish cheklovi yo'q.
U faqat uchta buyruqni qabul qiladi: hold hujumni boshlaydi, !ka barcha hujumlarni bekor qiladi va botni to'xtatadi, !ku esa botni qayta ishga tushiradi, shunda u hujum buyruqlarini yana qabul qiladi.
Binar faylda doimiylik, o'z-o'zini tarqatish, buyruq bajarish, yuk yuklab olish yoki anti-tahlil mantig'i yo'q. Uning saqlanib qolgan .gopclntab ramzlari kairos/methods.HoldFlood va kairos/methods.holdConn kabi belgilarni ochib beradi.
Bot har CPU yadrosi uchun 128 ta ishchini ishga tushiradi, minimal 256 ta. Shuning uchun 16 yadroli xost har hujumda 2 048 ta bir vaqtdagi ulanishni ochadi. Har bir ishchi besh soniyalik timeout bilan haqiqiy TCP qo'l siqishni bajaradi.
Keyin u har besh soniyada bitta bo'sh joy belgisi (0x20) yuborib, soketni ochiq saqlaydi. Muvaffaqiyatsiz ulanishlar har 100 millisekundda qayta urinishadi, bu esa rad etuvchi portga hujumni ulanish bo'roniga aylantiradi.
Bu soxta SYN to'plami emas, shuning uchun jabrlanuvchi buzilgan qurilmaning haqiqiy manba IP manzilini ko'radi. Katta hujumlar botning o'z fayl deskriptorlarini ham tugatishi mumkin. Katta Mirai hosilalari, masalan Evooo1Bot botneti bilan solishtirganda, Kairos minimal va bitta texnikaga asoslangan.
Bot os.Args[0] ni [kworker/0:1] ga qayta yozadi, bu yadro ipini taqlid qiladi. U asl argv xotirasini o'zgartirmaydi va prctl(PRSETNAME) ni chaqirmaydi, shuning uchun /proc//cmdline, comm va ps hali ham haqiqiy binarni ko'rsatadi.
[kworker/0:1] va kairos/bot qurilish yo'lini o'z ichiga olgan foydalanuvchi darajasidagi ELF deyarli aniq Kairosdir.
VirusTotal'da YARA qidiruvi ARM, MIPS (katta va kichik endianness) va 32-bit x86 uchun yana oltita namunani topdi. Barchasi ma'lum C2 172[.]86[.]85[.]39 dan foydalanadi.
Himoyachilar 91[.]92[.]42[.]84, 172[.]86[.]85[.]39 va 85[.]11[.]167[.]41 manzillariga 9999 va 8080 portlarida chiquvchi ulanishni bloklash, shuningdek hujumchi IP manzillari 103[.]124[.]165[.]53, 45[.]129[.]56[.]140 va 45[.]129[.]56[.]222 ni bloklash orqali muhitni himoya qilishlari mumkin.
Xavfsizlik jamoalari TCP/9999 da oddiy matnli REGISTER linux beaconi uchun IDS imzosini qo'shishlari, Telnetni o'chirishlari va standart yoki bo'sh parollarni almashtirishlari kerak. Bundan tashqari, administratorlar YARA qoidasini fayl va xotira skanerlash bo'yicha joylashtirishlari va ko'plab chiquvchi TCP ulanishlarini saqlab turgan "yadro ishchisi" jarayonlari haqida ogohlantirishlari kerak.
Har bir qurilish C2 manzilini o'zgartirgan holda kod bir xil qolganligi sababli, kodga asoslangan imzolar IP bloklaridan ko'ra uzoqroq davom etadi.
Nozomi Networks Labs has documented Kairos, a previously undocumented Go-based DDoS bot for Linux. It turns compromised Linux devices into attack nodes that exhaust a victim’s connection capacity with thousands of idle TCP sessions.
Honeypot telemetry captured three Kairos builds. They differ only in the hard-coded C2 address and the Go compiler patch level (1.27.0 and 1.27.1), which points to a build-per-C2 distribution model.
According to the technical analysis published by Nozomi Networks Labs, attackers gained access through Telnet using the default root user with an empty password. Like the Tengu Linux bot, the operator then ran a shell sequence from /tmp.
The sequence fetched the architecture-matched payload with wget, curl, BusyBox wget and TFTP in turn, using chmod 777 and background execution on each copy. In the sample chain, 172[.]86[.]85[.]39 hosted the payload on TCP/8080 and acted as C2 on TCP/9999.
.webp)
Captures of Telnet Execution and Command Downloading Chain (Image Source: nozominetworks)
The bot connects to one hard-coded IPv4 address on TCP/9999 and sends a plaintext beacon: REGISTER linux amd64 . A keepalive newline follows every two seconds. If the session drops, the bot redials every five seconds with no jitter or retry limit.
It accepts only three commands: hold starts the flood, !ka cancels all attacks and pauses the bot, and !ku resumes the bot so it accepts attack commands again.
The binary has no persistence, self-propagation, command execution, payload download or anti-analysis logic. Its intact .gopclntab exposed symbols such as kairos/methods.HoldFlood and kairos/methods.holdConn.
.webp)
Reverse Engineered Command Processing Logic (Image Source: nozominetworks)
The bot starts 128 workers per CPU core, with a minimum of 256. A 16-core host therefore opens 2,048 concurrent connections per attack. Each worker completes a real TCP handshake with a five-second timeout.
It then sends one space character (0x20) every five seconds to hold the socket open. Failed connections retry every 100 milliseconds, which turns an attack on a refusing port into a connect storm.
This is not a spoofed SYN flood, so the victim sees the infected device’s real source IP. Large attacks can also exhaust the bot’s own file descriptors. Compared with larger Mirai derivatives such as the Evooo1Bot botnet, Kairos is minimal and built around one technique.
The bot rewrites os.Args[0] to [kworker/0:1] to imitate a kernel thread. It does not change the original argv memory or call prctl(PRSETNAME), so /proc//cmdline, comm and ps still show the real binary.
A userland ELF containing both [kworker/0:1] and the build path kairos/bot is almost certainly Kairos.
A YARA hunt on VirusTotal found six more samples for ARM, MIPS (big and little endian) and 32-bit x86. All use the known C2 172[.]86[.]85[.]39.
Defenders can protect environments by blocking egress to 91[.]92[.]42[.]84, 172[.]86[.]85[.]39 and 85[.]11[.]167[.]41 on ports 9999 and 8080, and blocking the attacker IPs 103[.]124[.]165[.]53, 45[.]129[.]56[.]140 and 45[.]129[.]56[.]222.
Security teams should add an IDS signature for the plaintext REGISTER linux beacon on TCP/9999, disable Telnet, and replace default or empty passwords. Furthermore, administrators should deploy the YARA rule across file and memory scanning and alert on “kernel worker” processes holding many outbound TCP connections.
Because each build changes its C2 address while the code stays the same, code-based signatures last longer than IP blocks.