Kairos Hold'em: Dissecting a New Go-Based DDoS Botnet

Kairos is a newly documented Linux DDoS botnet written in Go that compromises machines via Telnet using default root credentials with empty passwords. It establishes hundreds to thousands of TCP connections to targeted services, maintaining them with minimal keepalive traffic to exhaust resources. The bot uses a simple three-command protocol and masquerades as a kernel worker thread. It supports multiple CPU architectures and uses a build-per-command-and-control distribution model.

• Iranian Botnet Exposed via Open Directory: 15-Node Relay Network and Active C2Malware2026-03-17
• Threat Brief: March 2026 Escalation of Cyber Risk Related to IranMalware2026-03-03
• Tracking the Expansion of ShinyHunters-Branded SaaS Data TheftCampaign2026-01-31
• Investigating the Infrastructure Behind DDoSia's AttacksMalware2025-12-16
• Sneeit WordPress RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet AttacksMalware2025-12-09