New PumaBot botnet brute forces SSH credentials to breach devices

A newly discovered Go-based botnet named PumaBot targets embedded Linux IoT devices (notably surveillance and traffic cameras) by receiving target IP lists from a C2 and brute-forcing SSH credentials; once access is gained it installs a persistent binary, injects SSH keys, and deploys payloads such as PAM rootkits and exfiltration daemons to harvest and send credentials to the C2. Darktrace documented the malware's infection flow, IoCs, and detection rules; the botnet's scale is unknown but its targeted approach and persistence enable potential lateral movement into deeper networks.