Cybersecurity researchers have disclosed details of an updated Internet-of-Things botnet framework dubbed TuxBot v3 Evolution that shows indications of being developed with assistance from a large language model, according to a new analysis.
The botnet framework targets IoT devices, including routers, IP cameras and network-attached storage systems, to recruit them into a distributed denial-of-service network. TuxBot v3 incorporates several new features compared to previous versions, including improved command-and-control communication protocols and expanded attack capabilities.
Researchers noted that portions of the bots code contain telltale signs of LLM assistance, such as verbose commenting and safety disclaimers embedded within the malware itself. In one instance, the AI complied with a request to generate botnet code but included a safety warning that the developer failed to remove before deployment. This suggests that even with guardrails in place, determined actors can adapt AI-generated code for malicious purposes.
The discovery highlights a growing concern in the cybersecurity community: the potential for AI tools to lower the barrier to entry for developing sophisticated malware. While the current version of TuxBot contains several implementation errors and inefficiencies that suggest a relatively inexperienced developer, the researchers warned that future iterations could become more dangerous as both the tools and the actors skills improve.
TuxBot primarily targets devices running Linux-based firmware, using known default credentials and unpatched vulnerabilities to gain access. Once infected, devices become part of a botnet that can be commanded to launch DDoS attacks, scan for additional vulnerable devices, or serve as relay points for other malicious traffic.
The findings were published as part of ongoing research into the intersection of AI and cybercrime, an area that security firms and government agencies are monitoring closely. The use of AI in cyberattacks is expected to increase as LLMs become more widely available and capable.
This article was adapted from The Hacker News. Read the original here.
