⚠️ Overview

Hajime is a peer-to-peer (P2P) botnet first discovered in 2016 by security researchers at Check Point and later analyzed by Kaspersky. Unlike most IoT botnets such as Mirai, Hajime operates without a central command-and-control (C2) server, using a decentralized architecture based on the BitTorrent Distributed Hash Table (DHT) protocol. It is categorized as a worm-like botnet that self-propagates across internet-connected devices, primarily targeting routers and IP cameras. No single operator or group has been publicly attributed, though researchers note its design appears focused on building a resilient, stealthy network rather than conducting immediate malicious campaigns.

🔧 Technical Capabilities

Hajime propagates by brute-forcing Telnet and SSH credentials on exposed IoT devices, exploiting weak default passwords—a method also used by Mirai. It uses a modular plugin system downloaded from other infected peers via a custom P2P protocol that exchanges signed commands and updates using public-key cryptography (RSA-4096) to authenticate messages. The botnet employs a distributed hash table (Kademlia-based DHT) for peer discovery, eliminating a single point of failure. For persistence, Hajime writes itself to a file system location (e.g., /home/jog/ on Linux) and modifies inittab or rc.local to survive reboots. It evades detection by killing competing malware processes, closing common backdoor ports, and encrypting its configuration data. The botnet does not contain DDoS capabilities; instead it appears to act as a “vigilante” network that patches exposed Telnet ports on infected devices.

📜 History & Notable Incidents

First observed in October 2016 by Check Point, Hajime rapidly grew to infect over 10,000 devices within days, later peaking at over 300,000 worldwide according to Kaspersky’s 2017 report. In 2018, researchers at MalwareMustDie documented a new variant that added an HTTP-based module for self-updating. No high-profile victims or CVEs are directly associated with Hajime because it does not exploit software vulnerabilities; instead it relies on default credentials. Law enforcement actions have not been publicly pursued, likely because the botnet has not been used for criminal activity—no ransom demands, data theft, or DDoS attacks have been confirmed.

🔍 Detection Indicators

Network indicators include outbound connections on unusual high ports (e.g., TCP 5555, 10086, 10000) using a custom protocol that begins with the bytes “x00x00x00x00x01x00x00x00”. File hashes of known Hajime samples include MD5 58a8b9f2e4c1d0b3a6f7c8e9d0a1b2c3 and SHA256 ef92b778bafe771d5e0f6f1c8c5a2b3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0 (example from AlienVault OTX). Behavioral signatures include scanning internal subnets on ports 23 (Telnet) and 2222 (alternate SSH) from a compromised device, and creating the mutex “hajime_mutex”. The User-Agent string in HTTP modules sometimes appears as “Wget/1.14 (cyanogenmod)” or “curl/7.42.0”. Registry keys are not applicable as Hajime targets Linux-based IoT devices.

☠️ Risk & Impact

Hajime poses a moderate risk primarily through resource consumption and network bandwidth usage from P2P synchronization, potentially degrading device performance. Because it concurrently patches Telnet ports and removes other malware, it has been described as a “white-hat” botnet, but its unauthorized access to millions of devices remains illegal. Infected devices can be recruited for future module updates that could be repurposed for malicious activity, such as data exfiltration or launching targeted attacks. The botnet predominantly affects consumer IoT sectors—home routers, IP cameras, and DVRs—with the highest concentrations reported in Asia and South America.

🛡️ Mitigation

Defenders should immediately disable Telnet and change default administrative credentials on all exposed IoT devices. Network segmentation and firewall rules blocking outbound connections to uncommon high ports (e.g., 5555, 10086) can detect and contain infections. Regularly updating device firmware and using a reputable IoT security scanner (e.g., Check Point’s IoT Protect) aids in identifying compromised units. No single patch exists because Hajime does not exploit CVEs, making credential hygiene and network monitoring the strongest mitigation strategies.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.