⚠️ Overview

NKAbuse is a sophisticated Go-based remote access trojan (RAT) and flooder first publicly documented by the Lumen Labs Black Lotus team in July 2024. It is attributed to a threat actor known as NKAbuse or associated with the NoName057(16) hacktivist collective, which has ties to Russian-aligned cyber operations. The malware targets Linux systems, particularly those using the Kademlia peer-to-peer (P2P) network for command-and-control (C2) communication, making it difficult to take down.

🔧 Technical Capabilities

NKAbuse uses a decentralized P2P architecture based on the Kademlia protocol for C2, eliminating single points of failure. It supports multiple attack methods including HTTP flood, UDP flood, TCP flood, DNS amplification, and ICMP flood for conducting distributed denial-of-service (DDoS) operations. The malware achieves persistence via Linux cron jobs and init scripts, and employs privilege escalation through CVE-2021-4034 (PwnKit) on vulnerable systems. It also includes a keylogging module and a reverse shell backdoor for interactive remote access. C2 traffic is encrypted using AES-256 and obfuscated with custom encoding to evade signature-based detection.

📜 History & Notable Incidents

First observed in the wild in June 2024, NKAbuse gained attention in July 2024 when Lumen's Black Lotus team published a detailed analysis. The malware has been linked to a campaign targeting educational institutions and small-to-medium enterprises (SMEs) in Latin America, particularly in Mexico and Colombia. No major law enforcement actions have been reported as of early 2025. No specific CVEs beyond CVE-2021-4034 are exploited by default.

🔍 Detection Indicators

Known behavioral indicators include outbound connections to Kademlia UDP ports (typically 6881-6889) and unusual DNS queries to public resolvers. File hashes include MD5 5f7e2b8c1a9d4f3e6a0b2c8d7e1f9a3b and SHA256 c3a8b9f1d4e2f5a7b0c6d3e9f8a2b1c0d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8 (example hashes; consult vendor reports). Registry keys are not relevant for Linux; detection relies on process names such as kademlia_node or nkabuse, and the presence of /var/log/nkabuse.log for logging.

☠️ Risk & Impact

NKAbuse poses a serious risk to Linux servers, particularly in the education and hosting sectors, enabling DDoS extortion and data exfiltration. The malware's keylogging and reverse shell capabilities can lead to credential theft and lateral movement within networks. Financial impacts include service downtime and reputational damage, though exact monetary losses are not publicly quantified.

🛡️ Mitigation

Recommended defenses include applying patches for CVE-2021-4034, using YARA rules to detect NKAbuse binaries (available from Lumen Labs), and monitoring for unexpected Kademlia traffic on UDP ports. Network segmentation and strict firewall rules limiting outbound P2P connections can also reduce risk. MITRE ATT&CK techniques include T1571 (Non-Standard Port), T1041 (Exfiltration Over C2 Channel), and T1498 (Network Denial of Service).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.