PumaBot Targets Linux Devices in Latest Botnet Campaign

PumaBot is a novel Go-based Linux botnet observed targeting IoT devices by retrieving target lists and credentials from a C2, then brute-forcing SSH rather than scanning the Internet. After gaining access it establishes persistence (writing to /lib/redis, adding SSH keys), fingerprints environments to avoid honeypots, exfiltrates system details in JSON to its C2, and is linked to a broader campaign including a Go backdoor, an SSH brute-forcer that self-updates, and a PAM rootkit used to steal credentials; researchers recommend monitoring SSH activity, auditing systemd services and authorized_keys, and alerting on suspicious outbound HTTP headers.