# TuxBot v3: AI-Assisted IoT Botnet Development Underway LLM-developed botnet signals a new era in cybersecurity threats. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-15 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/5fdf11d8-a059-4ae2-9542-1e80ebd026f9 ## AI-Powered Cyber Threat TuxBot v3 Evolution is a new IoT botnet framework developed using large language models (LLMs). Palo Alto Networks researchers found that the botnet code was generated by an LLM but included unremoved safety disclaimers. This case highlights the use of AI in developing cyberattack tools, marking a significant shift in threat landscapes. ## Technical Details of the Botnet TuxBot v3 consists of a C-based bot agent compilable for multiple architectures, a Go-based command-and-control server, and a custom exploit VM. The botnet can launch brute-force attacks via Telnet using 1,496 credential pairs and exploits over 30 IoT device families. Its modular design enhances its adaptability and evasion capabilities. ## Multi-Channel Communication The botnet employs encrypted TCP channels, SHA512-based domain generation algorithms (DGA), P2P gossip protocols, and IRC for communication. These multi-layered mechanisms make it resilient to takedowns. Fallback options like DNS TXT queries and HTTP polling ensure persistent connectivity even under adverse conditions. ## Origins and Development Timeline TuxBot v3 traces its lineage to botnets like Mirai, AISURU, and Wuhan, incorporating functions from the open-source MHDDoS toolkit. Development began in 2025, with samples uploaded to VirusTotal by January 2026. This timeline suggests the botnet has been operational for at least six months, evolving through iterative improvements. ## Operators and Targets TuxBot operators are linked to the Keksec ecosystem, known for managing multiple IoT botnets. The botnet targets routers, IP cameras, Android boxes, and poorly secured servers, aiming to disrupt services and conduct reconnaissance. Its encrypted C2 and modular exploits signify a move beyond traditional Mirai-based attacks. ## A New Era in Cybersecurity TuxBot v3 underscores the growing threat of AI-assisted cyberattacks. The misuse of LLMs for malware development challenges cybersecurity professionals to innovate defenses. Its modular architecture and multi-pronged C2 channels hint at increasingly sophisticated future threats, requiring proactive and adaptive security measures. ## Sources covering this story - https://thehackernews.com/2026/07/tuxbot-v3-evolution-shows-signs-of-llm.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._