Daily Cybersecurity
Threat Intelligence

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

Unit 42 analyzes TuxBot v3, an IoT botnet framework built using LLMs, detailing its cross-compiled binaries, C2 architecture, and bugs, highlighting the evolution of AI-assisted malware development.

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

This article provides an in-depth analysis of TuxBot v3, an IoT botnet framework built using LLM assistance. It examines the botnet's cross-compiled binaries, command-and-control architecture, and discovered vulnerabilities.

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

Unit 42 analyzes TuxBot v3, an IoT botnet framework built using LLMs, detailing its cross-compiled binaries, C2 architecture, and bugs, highlighting the evolution of AI-assisted malware development.

OkoBot: new sophisticated malware framework targets cryptocurrency users

In January 2026, Kaspersky identified a sophisticated malware framework, dubbed OkoBot, targeting cryptocurrency users. The malware captures cryptocurrency wallet contents and orchestrates attacks via an SSH tunnel, delivering over 20 malicious payloads, including TeviRAT, keyloggers, and stealers.

OkoBot: new sophisticated malware framework targets cryptocurrency users

Daxin Returns: Stealthy Malware Resurfaces in Taiwan Alongside a New Backdoor

Four years after Symantec first uncovered Daxin, the most advanced malware we had seen from a China-linked actor, it has been found running inside a Taiwan manufacturing firm, deployed with a novel new backdoor.