An IoT Botnet That Carries Four Privilege Escalation Exploits
Nozomi's analysis of KATARU finds Mirai-style DDoS bolted to four Linux privilege escalation paths, encrypted C2 — and a pinned public key lifted straight from an RFC test vector.
Nozomi Networks Labs published its analysis of KATARU on 9 September: an IoT malware family combining Mirai-style botnet functionality with Linux privilege escalation, persistence, encrypted command and control, and anti-analysis tricks.
Initial access is Telnet credential brute forcing. Once on a device, the malware attempts four escalation paths: CVE-2026-46300 (Fragnesia), CVE-2026-43284 (DirtyFrag), CVE-2026-31431 (Copy Fail) and the cgroup v1 release_agent escape technique. Command and control runs over a custom encrypted protocol on TCP port 6767, using X25519 key exchange and ChaCha20-Poly1305. The command set covers DDoS over TCP, UDP, ICMP, HTTP, QUIC and DNS, plus SSH brute forcing, binary download and execution, speed testing and remote shell.
The sloppiness is what gives the family away. The analysed sample targets ARM32 but contains x86 shellcode — copy-pasted exploit code with architecture mismatches nobody checked. Better still, Nozomi notes that the pinned key matches Alice's public key from the RFC 7748 X25519 test vectors. Someone implemented the key exchange by copying the worked example out of the specification. Nozomi's assessment is that the malware was assembled with AI assistance rather than developed as a mature family.
Entertaining, but not the reason to care. The reason is that CVE-2026-31431 is the same Linux kernel flaw CISA advised on for ABB Ability Edgenius eight days later. Public kernel escalation exploits are being bolted into commodity IoT malware within weeks of disclosure, and for an OT gateway that means the exposure window is now shorter than the change control process that governs patching it.