Threat Intelligence Report

TuxBot v3: Inside an IoT Botnet Framework With LLM-Assisted Development

📅 July 15, 2026 📰 unit42.paloaltonetworks.com 🔍 25 CVE(s) referenced

TuxBot v3 Evolution is a modular IoT botnet framework built with LLM-assisted development, featuring encrypted C2, DGA, and multi-architecture support, whose broken but easily fixable components make it a likely and escalating threat within the Keksec ecosystem.

vendor

CVE-2017-17215, CVE-2016-11021, CVE-2025-34037, CVE-2017-18377, CVE-2013-7471, CVE-2022-44877, CVE-2023-1389, CVE-2007-3010, CVE-2025-34117, CVE-2022-1388, CVE-2018-10562, CVE-2022-30525, CVE-2023-39780, CVE-2022-22965, CVE-2014-2321, CVE-2018-20062, CVE-2020-8515, CVE-2022-22947, CVE-2014-8361, CVE-2018-10561, CVE-2026-5815, CVE-2021-4045, CVE-2021-25646, CVE-2007-5693, CVE-2020-17456

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap

🎯 IOC Extraction

⚔️ MITRE ATT&CK TTPs

📦 STIX 2.1 Bundle