Kairos: New Go DDoS Bot Enters Linux and IoT Devices Through Empty-Password Root Telnet and Exhausts Targets With Thousands of Idle TCP Connections

Medium · 2026-11-07 · By H.A

Kairos: New Go DDoS Bot Enters Linux and IoT Devices Through Empty-Password Root Telnet and Exhausts Targets With Thousands of Idle TCP Connections

Researchers documented Kairos, a Go-based Linux DDoS bot spread through passwordless root Telnet logins that floods targets with low-bandwidth TCP connection-exhaustion attacks and is built per C2 server.

Overview

Researchers have documented Kairos, a previously unknown Linux DDoS bot written in Go that spreads through the oldest trick in the IoT book: Telnet logins as root with an empty password. Once installed, it does one thing — joins its operator's botnet and floods targets with a TCP connection-exhaustion attack that holds thousands of idle sockets open instead of blasting raw bandwidth.

The research, published on 29 October 2026, is based on honeypot captures and covers builds for x86_64, ARM, MIPS (big- and little-endian) and 32-bit x86.

The Campaign

Infection starts with a Telnet login using default credentials. A shell dropper then:

Command and control is plaintext TCP on port 9999 to a single hard-coded IPv4 address with no fallback. The bot registers with a REGISTER linux <arch> <NumCPU> message, sends a newline keepalive every two seconds, and redials every five seconds without jitter or a retry limit if the session drops.

Three captured builds differ only in their C2 address and Go compiler patch level (Go 1.27.0 and 1.27.1), which points to a build-per-C2 model: one codebase recompiled for each server — possibly for different customers.

The Attack

The bot understands just three commands:

Each attack spawns 128 workers per CPU core, minimum 256 — 2,048 on a 16-core host. Every worker completes a full TCP handshake and then sends a single space byte every five seconds to keep the connection alive. Failed connections are retried every 100 ms, creating a connect storm against closed ports. The effect is to fill the victim's connection table and worker pools, so legitimate users cannot connect even though traffic volume stays low and may slip under volumetric DDoS thresholds.

The traffic is not spoofed, so the source IPs of infected devices are visible — and the flood can exhaust the bot host's own file descriptors and connection-tracking table.

Timeline

Tradecraft

Kairos is deliberately minimal:

A reboot removes it, but the empty-password Telnet hole that let it in remains — so devices are typically reinfected.

Indicators of Compromise

IP addresses (C2 / delivery / scanning):

SHA-256 samples:

Strings and files: REGISTER linux, [kworker/0:1], kairos/bot, kairos/methods.HoldFlood, /tmp/.bot, .bot2, .bot3, .bot4.

Detection

# processes whose executable lives in /tmp or is named .bot*
for p in /proc/[0-9]*; do
  exe=$(readlink "$p/exe" 2>/dev/null) || continue
  case "$exe" in /tmp/*|*/.bot*) echo "$(basename $p) $exe $(cat $p/comm)";; esac
done
ls -la /tmp/.bot* 2>/dev/null
# hosts holding unusually many outbound connections
ss -tn state established | awk 'NR>1{print $4}' | sort | uniq -c | sort -rn | head

Recommended Actions

  1. Disable Telnet on every Linux, router and IoT device; where it cannot be removed, block TCP/23 from the internet.
  2. Set passwords on all root and default accounts — an empty root password should be treated as an incident.
  3. Block egress to the listed IPs, especially on TCP/9999 and TCP/8080, and alert on attempts.
  4. Deploy an IDS signature for the plaintext REGISTER beacon and the YARA rule across file scanning.
  5. For services that may be targeted, tune connection limits, idle timeouts and per-source connection caps so slow-connection floods cannot exhaust worker pools.
  6. Reboot and reflash any infected device after closing the Telnet hole; the bot has no persistence but reinfection is immediate otherwise.

Analyst Assessment

Kairos is technically unremarkable, but it is a reminder that empty-password Telnet still yields a steady supply of bots in 2026, and its low-bandwidth connection-exhaustion technique can defeat DDoS protection tuned only for volume. The build-per-C2 model suggests a small operation that may be selling or renting builds. We rate the threat Medium: low risk for well-managed networks, but a real availability concern for services behind thin connection limits and for anyone still exposing Telnet.

REEF SENTINEL