New Go-Based Botnet PumaBot Targets IoT Devices for Corporate Infiltration Security researchers at Darktrace have uncovered PumaBot, a sophisticated Go-based Linux botnet that brute-forces SSH credentials on embedded IoT devices—particularly surveillance and traffic cameras—to deploy malicious payloads. Unlike traditional botnets that scan the internet broadly, PumaBot operates with precision, targeting specific IP addresses provided by its command-and-control (C2) server (ssh.ddos-cc.org). The attack begins with the botnet receiving a curated list of target IPs from its C2. It then attempts to gain access via port 22 (SSH), checking for the string "Pumatronix"—a possible indicator of surveillance hardware from a specific vendor. Once inside, PumaBot verifies the device isn’t a honeypot by running uname -a, then establishes persistence by writing its binary (jierui) to /lib/redis and creating a systemd service (redis.service). It also injects its SSH key into authorized_keys to maintain access even if the primary infection is removed. Active infections enable further compromise, including data exfiltration, payload delivery, and lateral movement. Darktrace observed payloads such as self-updating scripts, a PAM rootkit that replaces pam_unix.so to harvest SSH credentials, and a daemon (binary "1") that monitors and exfiltrates stolen data stored in con.txt before wiping the file to cover its tracks. While the botnet’s scale remains unclear, its targeted approach suggests a focus on corporate network infiltration rather than low-level cybercrime like DDoS attacks. The discovery highlights the growing threat of IoT-focused malware designed to breach enterprise environments.