TuxBot: LLM-assisted malware leaves forensic fingerprints in its code

What is this?

On July 15, 2026, Palo Alto Networks Unit 42 published an analysis of TuxBot v3 Evolution, a previously unreported IoT botnet framework whose source code carries unmistakable signs of having been written with the help of a large language model. Researchers Chris Navarrete, Asher Davila and Doel Santos traced the framework to the Keksec ecosystem, alongside known families such as Mirai and AISURU, with at least one sample uploaded to VirusTotal on January 20, 2026.

The interesting part for defenders is not the botnet’s capabilities — those are a fairly standard Mirai-lineage toolkit — but what the author accidentally left behind. The developer shipped the model’s raw working notes, an AI safety disclaimer they forgot to delete, and cryptographic code the model appears to have hallucinated. Several functions in the analyzed samples simply do not work. The result is a rare, well-documented look at the forensic residue that LLM-assisted malware development can leave in a binary’s source.

How it works

TuxBot is modular: a C-based bot agent that cross-compiles for ARM, MIPS, x86_64, PowerPC and RISC-V, a Go-based command-and-control server with a DDoS-for-hire panel, a custom exploit VM, and an automated build system. The agent brute-forces Telnet with a list of credential pairs and bundles exploits for more than thirty IoT device families, falling back across several C2 channels (a domain-generation algorithm, a signed peer-to-peer gossip protocol, IRC, DNS TXT queries and HTTP polling). None of that is novel.

The tell-tale artifacts are. Unit 42 reports that multiple files contain raw chain-of-thought reasoning left verbatim in comments — the model’s own step-by-step notes as it worked through porting tasks, complete with self-interruptions, decisions, and references to “the user,” meaning the developer who prompted it. Separately, the model’s refusal-style safety disclaimer survived into shipped code, an artifact that only appears when generated text is pasted in without review. And the author shipped hallucinated cryptographic implementations without verifying them, which is a large part of why several features are broken.

Taken together these are behavioral fingerprints of a generate-and-paste workflow with no manual code review — exactly the kind of low-effort pipeline that lets a single operator assemble a multi-channel botnet quickly.

Why it matters

Two things follow, and they cut in opposite directions.

For defenders, LLM-assisted malware currently comes with a detection and attribution surface that hand-written malware does not. Verbatim reasoning comments, leftover assistant disclaimers, telltale identifier and comment styles, and clusters of non-functional-but-plausible code are all hunting signals. They also leak process intelligence: which components were ported, in what order, and where the author’s own competence dropped off. This is the same lesson as earlier reporting on AI-authored code fingerprints — machine-generated artifacts have a recognizable grain.

The uncomfortable half is that these artifacts are transient signs of inexperience, not of weakness. Unit 42 notes that a few targeted prompts were enough to fix several of the broken features, meaning an adversary with the same source could ship a more complete build with minimal effort. The barrier that produced this sloppy sample is a missing code-review step, not a limit on what the model can do. As operators learn to strip reasoning comments and test generated code, this particular fingerprint fades — so its value to defenders is real but time-limited.

Defenses

• Hunt for generation artifacts in recovered samples. Add YARA and grep rules for assistant-style disclaimers, first-person reasoning comments, references to “the user,” and other hallmarks of pasted model output. They are cheap to search for and, right now, common in low-skill malware.
• Treat non-functional-but-plausible code as a signal, not noise. Clusters of broken-yet-well-structured functions (especially hand-wavy crypto) point to unverified generation and can help cluster samples to an author or toolchain.
• Do not downgrade a threat because its current build is buggy. The same source plus a review pass yields a working tool. Prioritize on capability and lineage (here, Keksec / Mirai / AISURU), not on whether this specific sample runs.
• Harden the boring IoT basics. The agent’s actual entry vector is Telnet brute-forcing and known device exploits. Disable Telnet, change default credentials, segment and patch IoT/OT devices, and rate-limit outbound C2-like traffic. LLM assistance changes who can build a botnet, not how it gets in.
• Feed fingerprints into threat intel now. Because the artifact window is closing as operators mature, capture and share these indicators while they are still abundant.

Status

Item	Value
What	TuxBot v3 Evolution — modular IoT/DDoS botnet with LLM-assisted development
Disclosed	July 15, 2026 (Unit 42, Palo Alto Networks)
First seen	VirusTotal upload January 20, 2026; groundwork ~1 year earlier
Attribution	Keksec ecosystem; lineage with Mirai, AISURU, Wuhan; MHDDoS port
Key artifacts	Verbatim LLM reasoning in comments, unremoved safety disclaimer, hallucinated crypto
State	Under development; several functions non-functional in recovered sample
Scope	Threat-intel finding; no CVE, no patch (malware, not a product flaw)

Key dates: January 20, 2026 — first known sample on VirusTotal; July 15, 2026 — Unit 42 publication and press coverage. Both cited sources were published July 15, 2026.