HighZero-Day
Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet
Cyber Security News·Source published ·1 min read
What happened?
A new botnet called Kairos is spreading to Linux devices through a very old mistake: a Telnet service that accepts the root user with no password. Once inside, the attackers install a small Go-based program that turns the device into a node for DDoS operations. The campaign shows that basic security gaps still give attackers an easy path in. Kairos does not use a complex exploit or a zero-day flaw. The attackers connect to exposed Telnet services and log in as root with an empty password.
Key details
- Kairos botnet infects Linux devices via exposed Telnet with root empty password.
- Bot uses plain-text beacon REGISTER linux amd64 NumCPU to connect to C2.
- No persistence or self-spreading; relies on re-infection via Telnet.
- Three C2 commands: hold starts flood, !ka stops, !ku resumes attacks.
Fixes and mitigations
- Disable Telnet service and replace default or empty passwords.
What to look for
- Plain-text REGISTER linux amd64 beacon sent to C2 every two seconds.
- Outbound connections to C2 ports 9999 and 8080 from unknown devices.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.