KaijiMalware
Surfaced in late April 2020, Intezer describes Kaiji as a DDoS malware written in Go that spreads through SSH brute force attacks. Recovered function names are an English representation of Chinese words, hinting about the origin. The name Kaiji was given by MalwareMustDie based on strings found in samples.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io4 reports
ATT&CK techniques
6 of 45 · each with the sentence it comes from- T1036Masquerading
“| | T1036: Masquerading | Masquerade Task or Service |”
- T1110Brute Force
“Enforce Strong Authentication for SSH: Use public/private key authentication for SSH access to protect against brute force attacks.”
- T1543.002Systemd Service
“KAIJI creates the /boot/System.img.config file, which is an executable that is executed through the previously deployed Systemd services.”
- T1572Protocol Tunneling
“| | T1572: Protocol Tunneling | |”
- T1001Data Obfuscation
“| | T1001: Data Obfuscation | |”
- T1005Data from Local System
“| | T1005: Data from Local System | |”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Advent of Configuration Extraction, Part 1: Kaiji Configuration“Advent of Configuration Extraction, Part 1: Kaiji Configuration”
-
Tradecraft Tuesday Recap“…ple customers, dropping everything from cryptominers and a Linux backdoor (PeerBlight) to tunneling tools, Go-based implants, and even a Kaiji botnet variant.”
-
PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182“We also observed a Kaiji botnet variant being distributed through this campaign.”
-
Betting on Bots: Investigating Linux malware, crypto mining, and gambling API abuse“Shortly after the Kaiji deployment, the attacker used the www-data account to download a script named 00.sh from the URL hxxp://61.160.194.160:35130, which, after further investigation, also hosted several versions of RUDEDEVIL malware.”
Indicators in its reports
named in the reports above- 695909032488e343…8228e0f289e4in 1 report
- 38.165.44[.]205in 1 report
- hxxp://38.165.44[.]205/1in 1 report
- 45.76.155[.]14in 1 report
- api.qtss[.]ccin 1 report
- auto.c3pool[.]orgin 1 report
- hxxp://207.148.79[.]178:6608/sys.shin 1 report
- 207.148.79[.]178in 1 report
- hxxp://216.158.232[.]43:12000/sex.shin 1 report
- 216.158.232[.]43in 1 report
- hxxp://45.32.158[.]54/5e51aff54626ef7f/x86_64in 1 report
- 45.32.158[.]54in 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.