CampaignPublished 4 Jun 2025Updated 8 Jul 2025

PumaBot: Novel Botnet Targeting IoT Surveillance Devices

Source AlienVault OTX General

Description

A new Go-based Linux botnet named PumaBot has been identified targeting IoT devices, particularly surveillance systems. It brute-forces SSH credentials using lists from a C2 server, then deploys itself and establishes persistence. The malware disguises itself as legitimate system files, creates systemd services, and adds SSH keys for backdoor access. It also includes components for credential theft and system monitoring. The botnet demonstrates sophisticated evasion techniques and aims for long-term access to compromised devices.

Impact

For European organizations, the emergence of PumaBot presents a substantial risk, especially for entities relying on IoT surveillance devices such as smart cameras, IP-based security systems, and other Linux-based embedded devices. Compromise of these devices can lead to unauthorized access to sensitive video streams, enabling espionage, privacy violations, and potential manipulation of security monitoring. The persistence mechanisms and backdoor access allow attackers to maintain long-term control, facilitating further lateral movement within networks or use of compromised devices as part of larger botnet operations (e.g., DDoS attacks). The theft of credentials and system monitoring capabilities can expose internal network information, increasing the risk of broader compromise. Given the widespread adoption of IoT surveillance in sectors like critical infrastructure, transportation, retail, and public safety across Europe, the botnet could disrupt operational continuity and erode trust in security systems. Additionally, the botnet’s evasion techniques may delay detection and remediation, increasing the window of exposure. The medium severity rating reflects the balance between the complexity of exploitation (requiring brute-force attempts) and the significant impact on confidentiality and availability of surveillance systems.

Defensive guidance

European organizations should implement targeted measures beyond generic advice to mitigate PumaBot risks. First, enforce strong, unique SSH credentials on all IoT surveillance devices, avoiding default or weak passwords to prevent brute-force success. Deploy network segmentation to isolate IoT devices from critical internal networks, limiting lateral movement opportunities. Enable and monitor SSH login attempts, employing rate limiting and account lockout policies to disrupt brute-force attacks. Utilize multi-factor authentication (MFA) for SSH access where supported. Regularly audit devices for unauthorized systemd services, suspicious SSH keys, and disguised files indicative of PumaBot persistence. Employ endpoint detection solutions capable of identifying anomalous process behaviors and file modifications on Linux-based IoT devices. Maintain up-to-date firmware and software on surveillance devices, applying security patches promptly. Consider deploying honeypots or deception technologies to detect early intrusion attempts targeting IoT devices. Finally, establish incident response plans specifically addressing IoT device compromise, including rapid isolation and forensic analysis procedures.

Indicators of compromise

Domains 9

1.lusyn.xyz
multi-user.target
pumatronix.com
cadosecurity.com
dasfsdfsdfsdfasfgbczxxc.lusyn.xyz
db.17kp.xyz
dow.17kp.xyz
input.17kp.xyz
ssh.ddos-cc.org

Hashes 23

0e455e06315b9184d2e64dd220491f7e
1bd6bcd480463b6137179bc703f49545
48ee40c40fa320d5d5f8fc0359aa96f3
8b37d3a479d1921580981f325f13780c
a9412371dc9247aa50ab3a9425b3e8ba
be83729e943d8d0a35665f55358bdf88
cab6f908f4dedcdaedcdd07fdc0a8e38
cb4011921894195bcffcdf4edce97135
158f869a1ae3aa2a3586920e788a9110b7495b9d
1d6f623aa4ccb3ba89c19a1479a84067ada38f32

Yara 1

Rule to match on PumaBot samples

f540f7af0ba3995c2a35f623b83737456c93e55f

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Jul 2025, 03:12 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details

Indicators of compromise

Domains 9

Hashes 23

Yara 1

Community reviews

Related threats