PumaBot Malware Targets Linux IoT Devices

A botnet targeting Internet of Things devices running on the Linux operating system works by brute forcing credentials and downloading cryptomining software.

See Also: Cracking the Code: Securing Machine Identities

Researchers from Darktrace christened the botnet “PumaBot,” since its malware checks for the string “Pumatronix.” That’s the name of a Brazilian manufacturer of surveillance and traffic camera systems, “suggesting potential IoT targeting or an effort to evade specific devices.” The bot also fingerprints the environment to avoid honeypots or restricted shells.

Unusually for a botnet, the malware doesn’t scan the internet for opportunistic targets. Rather, it connects to a command and control server that delivers a list of IP addresses of devices that likely have open SSH ports. The domain associated with the server, ssh.ddos-cc.org, did not resolve to an Internet address at the time of the Darktrace analysis.

A key malicious use is to hijack compromised devices for cryptocurrency mining. By running cryptomining software on infected systems, the botnet drains the device’s processing power and energy resources. Analysts believe PumaBot could be part of a larger campaign to build a covert, long-term foothold in smart city or industrial surveillance networks.

PumaBot primarily focuses on stealthy infiltration and long-term control by writing a custom systemmd service unit, a configuration file that encapsulates information about system services and listening sockets. It also adds its own SSH keys into the authorized_keys file, ensuring persistence even should someone delete the rogue systemmd service unit file.

The malware installs itself in a hidden directory /lib/redis and creates deceptive systemd services such as redis.service and mysqI.service.

The malware communicates with its C2 using custom HTTP headers, including an unusual X-API-KEY, jieruidashabi. It sends back system fingerprints including architecture, kernel version and user credentials. The data helps operators maintain a real-time map of infected infrastructure and deploy tailored payloads when needed.

Darktrace also observed related binaries as part of the wider PumaBot campaign, including a persistent backdoor named ddaemon and a component called networkxm that performs SSH brute-forcing and self-updates via MD5 hash checks.

Another key piece is the installx.sh bash script, which modifies the Linux Pluggable Authentication Modules authentication stack with a malicious pam_unix.so file to harvest credentials across local and remote logins.

To exfiltrate data, a file watcher binary simply named “1” monitors stolen credentials stored in a hidden file con.txt, then sends them to a remote server. This data includes SSH credentials, system IP addresses and port scan results.

“While it does not appear to propagate automatically like a traditional worm, it does maintain worm-like behavior by and brute-forcing targets suggesting a semi-automated botnet campaign focused on device compromise and long term access,” researchers said.