[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZ7ICA6oF_DNxisHD9pqOMa6jSRHG9MHzeoFjcbZKdwI":3},{"article":4,"iocs":43,"watch_terms":51,"solutions":52,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"041bca87-5e55-416b-92d9-002b6897970a","Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet","hackers-exploit-passwordless-telnet-to-infect-linux-devices-with-new-kairos-ddos-91b436","A new botnet called Kairos is spreading to Linux devices through a very old mistake: a Telnet service that accepts the root user with no password. Once inside, the attackers install a small Go-based program that turns the device into a node for DDoS operations. The campaign shows that basic security gaps still give attackers […] The post Hackers Exploit Passwordless Telnet to Infect Linux Devices With New Kairos DDoS Botnet appeared first on Cyber Security News.","A new botnet called Kairos is spreading to Linux devices by exploiting passwordless Telnet services that accept root login with no password. Once installed, the Go-based malware turns infected devices into DDoS nodes capable of launching connection-based flood attacks. The campaign demonstrates how legacy security misconfigurations remain effective attack vectors despite their simplicity.","Kairos DDoS botnet infects Linux devices via passwordless Telnet root access.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-exploit-passwordless-telnet\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F10\u002FHackers-Exploit-Passwordless-Telnet-to-Infect-Linux-Devices-With-New-Kairos-DDoS-Botnet.webp","2026-10-30T13:22:22+00:00","2026-10-30T14:00:17.471951+00:00",8,[17,20,22],{"name":18,"type":19},"Telnet","technology",{"name":21,"type":19},"Go",{"name":23,"type":24},"Nozomi Networks","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":25,"icon":27,"name":28,"slug":29},null,"Malware","malware",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44,48],{"type":45,"value":46,"context":47},"ip","172.86.85.39","C2 server hosting Kairos payload on TCP 8080 and C2 on port 9999",{"type":29,"value":49,"context":50},"Kairos","Go-based DDoS botnet targeting Linux devices via Telnet exploitation",[23],{"controls":53,"vendors":139},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":84,"name":85,"problem":86,"products":87},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":113,"name":114,"problem":115,"products":116},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[117,123,131],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":118,"product_name":119,"url":121,"description":122},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","umbrella","Cisco Umbrella","https:\u002F\u002Fumbrella.cisco.com\u002F","DNS-layer security and secure web gateway delivered from the cloud.",[140],{"slug":141,"name":23,"logo_path":142,"roles":143},"nozomi-networks","\u002Fvendor-logos\u002Fnozomi-networks.png",[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"passwordless-telnet-enables-kairos-botnet-to-hijack-linux-devices","Passwordless Telnet Enables Kairos Botnet to Hijack Linux Devices","The Kairos botnet exploits one of the most fundamental security misconfigurations possible: Telnet services left open with no password protection and root login enabled. These legacy protocol exposures are entirely preventable through basic hardening practices, yet remain widespread enough to fuel active DDoS campaigns. The simplicity of the attack vector underscores that attackers do not need sophistication when defenders leave foundational controls unaddressed. Organizations running embedded Linux devices or IoT hardware are particularly at risk because these devices are often deployed and forgotten without ongoing security review.",[150,151,152,153,154,155,156],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 13: Network Monitoring and Defense",{"NIS2 Article 21(2)(b)":158,"NIST SP 800-53 SI-2: Flaw Remediation":159,"CIS Control 13: Network Monitoring and Defense":160,"CIS Control 12: Network Infrastructure Management":161,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":162,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"NIS2 mandates incident handling and baseline security hygiene for essential and important entities; leaving Telnet open with no authentication directly contradicts the minimum security measures required.","While not a software vulnerability per se, the misconfiguration represents a known-bad state; systematic identification and remediation of insecure service configurations falls under flaw remediation disciplines.","Continuous network monitoring would have detected the anomalous outbound DDoS traffic patterns generated by infected devices, enabling faster identification and isolation of compromised hosts.","Proper network segmentation and access control policies would have limited attackers' ability to reach Telnet-exposed devices from the internet and contained infected nodes from participating in DDoS floods.","This control requires organizations to identify and remediate technical vulnerabilities, including dangerous misconfigurations like unauthenticated remote access services, before they can be exploited.","Permitting passwordless Telnet with root access is a direct violation of secure configuration baselines; enforcing hardened standards before deployment would have prevented this exposure entirely.","This function requires that access to systems be authenticated and authorized; a service accepting root login with no password represents a complete failure of this control."]