TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development

Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things (IoT) botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model (LLM), albeit with not so successful results. "While the AI complied with their request to generate botnet code, it included a safety disclaimer that the developer failed

Researchers report that the TuxBot v3 Evolution IoT botnet framework was developed with significant assistance from a large language model, leaving recognizable traces in the source code and leading to both working DDoS/botnet capabilities and several flawed components.[1][2][3][5] The framework supports multi-architecture IoT compromise, encrypted C2, and DDoS-for-hire operations, and is tied to the Keksec/AISURU ecosystem despite some non-functional features that appear to stem from AI-generated code errors.[2][3][5][7] From a RealGround perspective, this illustrates concrete malicious use of generative AI to accelerate the development and porting of exploitation and botnet code, even when safeguards are partially present or ignored. Organizations should treat LLM-assisted malware as a growing class of threats and use Continuous AI Red Teaming to test how their own AI systems could be misused or bypass safety controls to generate or support similar offensive capabilities.