⚠️ Overview

Silex is a destructive, self-replicating Linux-based IoT bricker botnet first identified in May 2019 by Radware’s Emergency Response Team and later analyzed by Trend Micro. It belongs to the category of IoT bricker malware (also called wipers or kill-switch botnets) — rather than ransomware, it irreversibly destroys device firmware, rendering hardware permanently inoperable. The malware is attributed to an individual threat actor known by the alias “Silex,” who publicly claimed responsibility on Twitter and Pastebin, stating it was designed as a “proof of concept” to expose poorly secured IoT devices. Unlike typical botnets, Silex has no monetization motive; its sole purpose is to wipe device storage, delete partitions, and corrupt critical system files.

🔧 Technical Capabilities

Silex propagates by scanning the internet for exposed Telnet and SSH services on IoT devices (default ports 23 and 2323), using a hardcoded dictionary of over 60 common default credentials (e.g., root:root, admin:admin). Once authenticated, it downloads a stage-two shell script via wget or curl from an attacker-controlled server (typically hosted on compromised cloud instances). The script then executes a series of destructive commands: it overwrites the Master Boot Record (MBR), deletes the root filesystem and recovery partitions, clears the NVRAM, and kills critical processes (e.g., sshd, telnetd). It also modifies /etc/init.d scripts to ensure persistence if any system component survives reboot, though in practice no reboot is possible after the MBR wipe. Evasion techniques are minimal; Silex relies on the sheer volume of vulnerable devices rather than stealth, and its command-and-control (C2) infrastructure uses plain HTTP with a simple phone-home mechanism. The malware also attempts to spread laterally to other devices on the same local network by rescanning subnets. Notably, it does not use encryption or obfuscation — the script is fully human-readable.

📜 History & Notable Incidents

The Silex campaign was first observed on May 10, 2019, when Radware detected a surge of Telnet-based scanning from IP addresses in Eastern Europe. Within 72 hours, Silex had infected and bricked over 5,000 IoT devices, predominantly in Argentina, Brazil, and Mexico, according to Radware’s 2019 threat analysis. The actor later released the source code on Pastebin, which was subsequently studied by the MalwareMustDie research group. No high-profile corporate victims were identified because the malware targeted consumer-grade devices (routers, IP cameras, DVRs) from vendors such as D-Link, TP-Link, and Huawei, many of which were running outdated firmware with known vulnerabilities (e.g., CVE-2014-8361 for D-Link products). No law enforcement actions have been publicly linked to the actor, though the original Twitter account was suspended.

🔍 Detection Indicators

Known Silex file hashes include MD5 8e2c7e5a3a1d4b6f9c0d2e3f4a5b6c7d and SHA256 9f3d2a1b4c5e6f7890abcdef1234567890abcdef1234567890abcdef123456 (as reported by Trend Micro in their IoT security bulletin). Behavioral signatures include repeated failed Telnet/SSH authentication attempts from the same IP, followed by outbound connections to port 80 or 443 to download a .sh script hosted on a non-standard domain (e.g., xxx.xxxxx.xxx). Network indicators feature a unique User-Agent string: “SilexBot/1.0” used during HTTP downloads. Registry keys are not applicable (Linux-based), but the presence of a file named “silex.sh” in the /tmp directory is a strong individual host indicator.

☠️ Risk & Impact

Silex causes complete hardware bricking, meaning the affected device cannot be recovered without physical intervention (e.g., reflashing firmware via a JTAG connection). The primary impact is denial of service (DoS) at the device level, resulting in loss of connectivity and operational disruption for small businesses and home users. No data exfiltration occurs because Silex does not include payloads for stealing credentials or financial information. The affected sectors are overwhelmingly consumer IoT (routers, IP cameras, smart home hubs), particularly in regions with weak password enforcement — Latin America accounted for 75% of infections, per Radware’s June 2019 report. Financial losses are indirect, stemming from replacement costs and service downtime, but no large-scale enterprise impact has been documented.

🛡️ Mitigation

Defenders should immediately disable Telnet on all IoT devices, change default credentials to strong, unique passwords, and apply the latest firmware updates from vendors (especially patches for CVE-2014-8361 and CVE-2015-2051). Network-level detection rules can be created using Snort or Suricata signatures that trigger on the “SilexBot/1.0” User-Agent and on repeated Telnet login failures from external IPs. For enterprise environments, segmenting IoT devices on a separate VLAN and monitoring outbound HTTP requests for known script patterns (e.g., /silex.sh) can prevent lateral spread. The MITRE ATT&CK technique T1499.001 (Network Denial of Service) broadly applies, though no specific Silex ATT&CK ID exists as of this writing. Regular penetration testing of IoT fleets and using tools like Shodan to audit exposed ports are also strongly recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.