PALO Alto Networks' Unit 42 has identified a new IoT botnet called TuxBot v3 Evolution that was built with the help of a large language model according to their research. The botnet spreads by brute‑forcing Telnet interfaces using more than 1,400 credential pairs and poses a growing threat to poorly secured smart devices.
The infection chain begins with a Telnet scanner that tries username and password combinations from a hard-coded list, then drops a malicious binary that establishes persistence through multiple mechanisms such as startup scripts and registry-like tricks on Linux-based firmware as detailed by Unit 42. Once installed, the malware opens an encrypted command-and-control channel that can launch various DDoS attacks including UDP floods and SYN floods.
Analysis of the sixty‑one C source files shows that the developer left the large language model’s safety disclaimers in the code, a clear sign that AI assisted the writing as reported by Security Affairs. Despite the polished appearance, the AI‑generated code contains numerous bugs, especially in the C2 authentication module, which limits the botnet’s reliability but does not stop its scanning and brute‑forcing functions.
Unit 42 observed activity from July 16 to July 21 2026, indicating that the botnet was actively scanning and attempting infections during that window according to the original advisory. Although no specific threat actor has been attributed, the code shares similarities with tools linked to the Keksec ecosystem, suggesting a possible connection.
Defenders should start by changing any default credentials on IoT devices and disabling Telnet access unless it is strictly required as advised by Security Online. Keeping device firmware up to date and placing IoT assets on an isolated network segment reduces the chance of successful brute‑force attempts.
Additionally, monitoring network traffic for connections to uncommon TCP ports can help spot command‑and‑control beaconing, while deploying intrusion detection rules that flag repeated Telnet login failures provides early warning. Applying the principle of least privilege to management interfaces and reviewing logs for unusual outbound traffic completes a basic hardening posture against this and similar threats.