PumaBot Malware Targets Linux IoT Devices

Stealthy Malware Installs Cryptomining Software Prajeet Nair (@prajeetspeaks) • May 28, 2025

A botnet targeting Internet of Things devices running on the Linux operating system works by brute forcing credentials and downloading cryptomining software.

See Also: OnDemand | Navigate the threat of AI-powered cyberattacks

Researchers from Darktrace christened the botnet "PumaBot," since its malware checks for the string "Pumatronix." That's the name of a Brazilian manufacturer of surveillance and traffic camera systems, "suggesting potential IoT targeting or an effort to evade specific devices." The bot also fingerprints the environment to avoid honeypots or restricted shells.

Unusually for a botnet, the malware doesn't scan the internet for opportunistic targets. Rather, it connects to a command and control server that delivers a list of IP addresses of devices that likely have open SSH ports. The domain associated with the server ...