Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet
Kairos DDoS botnet infects Linux devices via passwordless Telnet root access.
A new botnet called Kairos is spreading to Linux devices by exploiting passwordless Telnet services that accept root login with no password. Once installed, the Go-based malware turns infected devices into DDoS nodes capable of launching connection-based flood attacks. The campaign demonstrates how legacy security misconfigurations remain effective attack vectors despite their simplicity.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Nozomi Networks?
Get an email when a new story names Nozomi Networks, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Kairos botnet exploits one of the most fundamental security misconfigurations possible: Telnet services left open with no password protection and root login enabled. These legacy protocol exposures are entirely preventable through basic hardening practices, yet remain widespread enough to fuel active DDoS campaigns. The simplicity of the attack vector underscores that attackers do not need sophistication when defenders leave foundational controls unaddressed. Organizations running embedded Linux devices or IoT hardware are particularly at risk because these devices are often deployed and forgotten without ongoing security review.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- ip — 172.86.85.39
- malware — Kairos