New TuxBot v3 IoT Botnet Uses LLM-Generated Code to Hijack Devices and Launch DDoS Attacks

Unit 42 researchers identified TuxBot v3, a modular IoT botnet framework leveraging LLM-generated code to target routers, cameras, and other Linux-based devices across at least 17 architectures; it performs credential attacks, scanning, persistence, and encrypted C2 communications to support DDoS-for-hire operations. The recovered source and samples show active DDoS capabilities and many operational IoCs (IPs, domains, filenames, SHA-256 hashes), while some LLM-introduced defects limit functionality but could be fixed by operators; recommended mitigations include removing default credentials, restricting remote management, patching firmware, network segmentation, and monitoring for anomalous authentication and outbound traffic.