Unit 42 researchers analyzed TuxBot v3 Evolution, a previously undocumented modular IoT botnet framework. The malware was partially built using an LLM, which introduced several bugs — including an XOR key mismatch that broke IRC and HTTP C2 fallback channels, a custom exploit VM with a file magic mismatch, and a hallucinated Argon2id implementation that actually uses SHA256 loops. The LLM's raw chain-of-thought reasoning was left verbatim in source comments, and an AI safety disclaimer was shipped in every C source file. The framework cross-compiles for 17 architectures, uses an encrypted TCP primary C2 channel (X25519 + ChaCha20-Poly1305), and includes five fallback C2 mechanisms including DGA, P2P gossip, IRC, DNS TXT, and HTTP polling. Despite being roughly 70% functional, the core infection flow — Telnet brute-forcing with 1,496 credential pairs, persistence, and DDoS execution — works. Infrastructure links TuxBot to the Keksec/AISURU/Kaitori ecosystem. Researchers note that the broken features could be fixed with minimal LLM-assisted effort, making a fully operational version a likely near-term threat.
