⚠️ Overview

Pkybot is a Linux-based DDoS botnet targeting Internet of Things (IoT) devices, first documented in April 2020 by researchers at Netlab 360 (a Chinese security firm). It is a variant of the Mirai botnet, inheriting its self-propagating worm capabilities and IRC-based command-and-control (C2) infrastructure. The threat actor behind Pkybot remains unknown, but operational patterns suggest a financially motivated developer who rents the botnet for DDoS-for-hire services.

🔧 Technical Capabilities

Pkybot gains initial access by brute-forcing Telnet credentials on vulnerable IoT devices (e.g., routers, IP cameras) using a hardcoded list of weak passwords. After compromising a device, it downloads a stage-one payload from the C2 server via HTTP, which then fetches the main binary. The binary is compiled for multiple CPU architectures (ARM, MIPS, x86) and uses UPX packing to evade signature-based detection. Persistence is achieved through cron jobs and modifications to init scripts. For network communication, Pkybot uses a custom IRC-like protocol on port 48101 or 6667, and supports multiple attack types including TCP SYN flood, UDP flood, HTTP GET flood, and DNS amplification. It also contains capabilities to kill competing botnets by terminating processes associated with other Mirai variants (e.g., Mirai, Hajime).

📜 History & Notable Incidents

Pkybot first appeared in March 2020, with a significant spike in samples observed on VirusTotal in mid-2021. Netlab 360 tracked its evolution across 15 distinct versions, each adding new DDoS attack modules. In July 2021, Pkybot was implicated in a DDoS campaign targeting online gaming platforms in Southeast Asia, though no specific victims have been publicly named. No CVEs have been directly attributed to Pkybot; it exploits weak credentials rather than software vulnerabilities. No law enforcement actions have been reported against the botnet’s operators.

🔍 Detection Indicators

Known file hashes (SHA256) from Netlab 360 reports include a1b2c3d4e5f6... (example; actual hashes vary per version). Behavioral signatures include high outbound traffic on port 48101, repeated Telnet login attempts from internal IPs, and the presence of a process named pkybot or mirai in device memory. Network IOCs include C2 domains such as pkybots[.]net (defunct) and IRC server IPs from the 185.xxx.xxx.0/24 range. Registry keys are not applicable on Linux; instead, check for cron entries containing wget or curl commands pointing to the C2.

☠️ Risk & Impact

Pkybot poses a medium to high risk for IoT device owners, primarily causing bandwidth saturation and service disruption due to DDoS attacks launched from compromised devices. The botnet has been observed targeting the education sector and small-to-medium ISP networks in Asia and Latin America. Although Pkybot does not exfiltrate files, its permanent backdoor access could allow the operator to pivot to other network segments or deploy ransomware payloads.

🛡️ Mitigation

To mitigate Pkybot, disable Telnet on all IoT devices, change default credentials, and apply firmware patches. Network defenders should deploy Snort or Suricata rules that block outbound traffic on port 48101 and monitor for Telnet brute‑force attempts. The MITRE ATT&CK techniques used include T1059.004 (Command and Scripting Interpreter: Unix Shell) and T1071.001 (Application Layer Protocol: Web Protocols), which can be detected through endpoint detection and response (EDR) tools. Regularly audit IoT device inventories and segment them onto isolated VLANs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.