A sophisticated new Go-based Linux botnet called PumaBot has been discovered targeting embedded IoT devices, particularly surveillance and traffic camera systems, through SSH credential brute-forcing attacks.

## Targeted Attack Strategy

Unlike typical botnets that scan the internet indiscriminately, PumaBot employs a more focused approach. It receives specific IP target lists from its command-and-control (C2) server at ssh.ddos-cc.org and attempts to breach these systems through port 22. During its reconnaissance, the malware specifically searches for the “Pumatronix” string, suggesting a deliberate focus on surveillance camera infrastructure.

## Infection Process

Once PumaBot identifies potential targets, it:
1. Tests compromised credentials against the target systems
2. Runs ‘uname -a’ to verify the environment and detect honeypots
3. Installs its main binary (jierui) in /lib/redis
4. Creates a systemd service (redis.service) for persistence
5. Injects its SSH key into ‘authorized_keys’ as a backup access method

## Advanced Capabilities

When successfully deployed, PumaBot can:
– Exfiltrate sensitive data
– Deploy additional payloads
– Facilitate lateral movement within networks

Researchers at Darktrace have observed several malicious components, including:
– Self-updating scripts
– PAM rootkits replacing legitimate ‘pam_unix.so’ files
– A “watcher” daemon that harvests SSH credentials, stores them in a text file (con.txt), and exfiltrates them to the C2 server before wiping evidence

## Implications

PumaBot represents a concerning evolution in botnet tactics, focusing on strategic targets that could enable deeper corporate network infiltration rather than simply using infected devices for DDoS attacks or proxying.

## Protection Recommendations

To defend against such threats:
– Update IoT firmware regularly
– Change default credentials
– Implement firewall protection
– Isolate IoT devices in separate networks away from critical systems