A newly discovered Go-based Linux botnet malware named PumaBot is brute-forcing SSH credentials on embedded IoT devices to deploy malicious payloads.

PumaBot hijacks Linux IoT devices via SSH brute-force, fakes Redis services, and mines crypto using stealthy rootkits.

Darktrace investigated “PumaBot,” a Go-based Linux botnet targeting IoT devices. It avoids internet-wide scanning, instead using a C2 server to get targets and brute-force SSH credentials. Once inside...

PumaBot hijacks Linux IoT devices via SSH brute-force, fakes Redis services, and mines crypto using stealthy rootkits.

Darktrace uncovers PumaBot, a stealthy Linux botnet using Go binaries, SSH brute-force, and rootkits to compromise IoT devices, aiming for persistent, undetected access.

PumaBot targets Linux IoT devices, using SSH brute-force attacks to steal credentials, spread malware, and mine crypto.

A botnet targeting Internet of Things devices works by brute forcing credentials and downloading cryptomining software. Researchers call the botnet

A newly discovered Go-based Linux botnet malware named PumaBot is brute-forcing SSH credentials on embedded IoT devices to deploy malicious payloads.

Robbinhood operator pleads guilty, PumaBot hits IoT via SSH brute-force attacks, and DragonForce expands RMM exploits via an affiliate model.

A sophisticated new malware strain dubbed PumaBot has emerged in the cybersecurity landscape, specifically targeting Internet of Things (IoT) devices through aggressive SSH credential brute-forcing campaigns. This latest threat represents a significant evolution in IoT-focused malware, demonstrating advanced persistence mechanisms and stealth capabilities that allow it to maintain long-term access to compromised devices across diverse network infrastructures. The malware first appeared in late 2024, initially targeting poorly secured IoT devices including IP cameras, routers, and industrial control systems that maintain default or weak SSH credentials. Jierui functions (Source – DarkTrace) PumaBot’s attack methodology begins with systematic network scanning to identify devices with exposed SSH services, followed by dictionary-based brute force attacks using common username and password combinations. Once successful authentication occurs, the malware establishes persistent backdoors and begins recruiting the compromised device into its expanding botnet infrastructure. DARKTRACE analysts recently identified PumaBot during routine threat hunting operations, noting its sophisticated evasion techniques and multi-stage payload delivery system. The researchers observed that unlike traditional IoT malware families, PumaBot employs advanced anti-analysis measures including process name obfuscation, memory-only execution phases, and dynamic command-and-control server rotation to avoid detection by conventional security monitoring systems. The impact of PumaBot infections extends beyond typical botnet activities, as the malware establishes comprehensive device control that enables various malicious operations including distributed denial-of-service attacks, cryptocurrency mining, and lateral movement within enterprise networks. Organizations with large IoT deployments face particular risk, as a single compromised device can serve as an entry point for broader network infiltration and data exfiltration activities. Current intelligence suggests PumaBot has successfully compromised tens of thousands of devices globally, with infections concentrated in regions with high IoT device density and inadequate cybersecurity practices . The malware’s ability to persist through device reboots and firmware updates makes remediation particularly challenging, requiring comprehensive device reimaging and credential rotation to ensure complete removal. Advanced SSH Exploitation and Persistence Mechanisms PumaBot’s SSH exploitation capabilities represent a significant advancement in automated credential compromise techniques, utilizing sophisticated wordlist generation and adaptive timing mechanisms to evade rate-limiting protections. The malware employs a multi-threaded approach to credential testing, dynamically adjusting connection attempts based on target device responses and implementing intelligent delays to avoid triggering security monitoring systems. The initial compromise phase begins with PumaBot’s scanning module identifying potential targets through port enumeration and service fingerprinting. Upon discovering SSH services on port 22 or alternative configurations, the malware initiates credential testing using an embedded dictionary containing over 50,000 username and password combinations, including device-specific defaults and commonly observed weak credentials. The following code snippet demonstrates the core authentication logic:- def ssh_bruteforce(target_ip, port=22): for username, password in credential_pairs: try: ssh_client = paramiko.SSHClient() ssh_client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ssh_client.connect(target_ip, port, username, password, timeout=10) return establish_persistence(ssh_client, target_ip) except paramiko.AuthenticationException: continue except Exception as e: break return False Once successful authentication occurs, PumaBot immediately deploys its persistence framework through multiple redundant mechanisms designed to survive system maintenance and security updates. The malware creates hidden system services, modifies startup scripts, and establishes cron job entries that ensure automatic execution following device reboots. Additionally, PumaBot implements a novel technique involving SSH key injection, where it generates and installs authorized public keys that provide password-free access for future connections. The persistence architecture includes a sophisticated watchdog system that monitors for removal attempts and automatically reinstalls components if deletion is detected. This resilience mechanism operates through distributed file placement across multiple system directories and employs file attribute manipulation to hide malicious components from standard administrative tools. The comprehensive persistence strategy employed by this advanced threat demonstrates the multiple layers of system integration that enable long-term device compromise and control. Celebrate 9 years of ANY.RUN!  Unlock the full power of  TI Lookup plan (100/300/600/1,000+ search requests), and  your request quota will double . The post New PumaBot Hijacks IoT Devices by Brute Forcing SSH Credentials For Persistence appeared first on Cyber Security News .

Blog com notícias sobre, Linux, Android, Segurança , etc

A newly discovered Go-based Linux botnet malware named PumaBot is brute-forcing SSH credentials on embedded IoT devices to deploy malicious payloads.

A newly discovered Go-based Linux botnet malware named PumaBot is brute-forcing SSH credentials on embedded IoT devices to deploy malicious payloads. [...]

PumaBot hijacks Linux IoT devices via SSH brute-force, fakes Redis services, and mines crypto using stealthy rootkits.

In today’s connected world, IoT devices are becoming increasingly common, powering everything from home automation to industrial systems. However, this rapid growth has also expanded the attack surface for cybercriminals. A recent discovery of the Pumabot botnet demonstrates how attackers are exploiting weak security, particularly poor SSH credential management, to breach and control vulnerable devices. […] The post New Pumabot Botnet Brute-Forces SSH Credentials to Hijack IoT Devices appeared first on Linux Today.

  A recently found malware called PumaBot is putting many internet-connected devices at risk. This malicious software is designed to attack smart systems like surveillance cameras, especially those that use the Linux operating system. It sneaks in by guessing weak passwords and then quietly takes over the system. How PumaBot Finds Its Victims Unlike many other threats that randomly scan the internet looking for weak points, PumaBot follows specific instructions from a remote command center. It receives a list of selected device addresses (known as IPs) from its control server and begins attempting to log in using common usernames and passwords through SSH — a tool that lets people access devices remotely. Experts believe it may be going after security and traffic camera systems that belong to a company called Pumatronix, based on clues found in the malware’s code. What Happens After It Breaks In Once PumaBot gets into a device, it runs a quick check to make sure it's not inside a fake system set up by researchers (known as a honeypot). If it passes that test, the malware places a file on the device and creates a special service to make sure it stays active, even after the device is restarted. To keep the door open for future access, PumaBot adds its own secret login credentials. This way, the hackers can return to the device later, even if some files are removed. What the Malware Can Do After it takes control, PumaBot can be told to: • Steal data from the device • Install other harmful software • Collect login details from users • Send stolen information back to the attackers One tool it uses captures usernames and passwords typed into the device, saves them in a hidden file, and sends them to the hackers. Once the data is taken, the malware deletes the file to cover its tracks. Why PumaBot Is Concerning PumaBot is different from other malware. Many botnets simply use infected devices to send spam or run large-scale attacks. But PumaBot seems more focused and selective. Instead of causing quick damage, it slowly builds access to sensitive networks — which could lead to bigger security breaches later. How to Protect Your Devices If you use internet-connected gadgets like cameras or smart appliances, follow these safety steps: 1. Change factory-set passwords immediately 2. Keep device software updated 3. Use firewalls to block strange access 4. Put smart devices on a different Wi-Fi network than your main systems By following these tips, you can lower your chances of being affected by malware like PumaBot.

While the botnet may not be completely automated, it uses certain tactics when targeting devices that indicate that it may, at the very least, be semiautomated.

A newly discovered Go-based Linux botnet malware named PumaBot is brute-forcing SSH credentials on embedded IoT devices to deploy malicious payloads.