A new botnet called PumaBot is actively targeting embedded Linux-based IoT devices through SSH brute-force attacks. Written in the Go programming language, this sophisticated threat aims to expand its network and deliver additional malware to compromised systems.

## How PumaBot Operates

Unlike traditional botnets that scan the internet randomly, PumaBot retrieves specific target lists from its command-and-control (C2) server before launching brute-force attacks against SSH instances. According to Darktrace’s analysis, “Upon gaining access, it receives remote commands and establishes persistence using system service files.”

The malware performs several verification checks during its attacks to ensure the target system is suitable and not a honeypot. Interestingly, it specifically checks for the string “Pumatronix,” a manufacturer of surveillance and traffic camera systems, suggesting these devices may be either targeted or excluded.

## Persistence Mechanisms

After successful infection, PumaBot:
– Disguises itself as a legitimate Redis system file by writing to “/lib/redis”
– Creates persistent systemd services named either “redis.service” or “mysqI.service” (using a capital “I” to mimic “mysql”)
– Collects and exfiltrates basic system information to its C2 server
– Executes commands received from the server, including cryptocurrency mining operations

## Broader Campaign Components

Researchers discovered additional components deployed as part of this campaign:
– “ddaemon”: A Go-based backdoor that retrieves and executes additional malware
– “networkxm”: An SSH brute-force tool similar to the initial infection stage
– “installx.sh” and “jc.sh”: Shell scripts that download and execute additional malicious components
– A modified “pam_unix.so” file that acts as a rootkit to steal credentials
– A monitoring binary that exfiltrates stolen credentials

## Protection Recommendations

To defend against PumaBot, organizations should:
– Monitor for anomalous SSH login activity, especially failed login attempts
– Regularly audit systemd services
– Review authorized_keys files for unknown SSH keys
– Apply strict firewall rules to limit exposure
– Filter HTTP requests with non-standard headers like “X-API-KEY: jieruidashabi”

Darktrace concludes that PumaBot “demonstrates an intent to evade defenses” through its sophisticated techniques, including mimicking legitimate binaries and embedding fingerprinting logic to avoid detection.