Botnet
Tsunami
First seen: 2010 • Status: active
Currently Active Threat
Tsunami is an old but still active Linux botnet that hackers control through chat rooms to launch attacks.
Overview
Tsunami is an IRC-based Linux botnet used for DDoS attacks. Various variants target different vulnerabilities and are commonly deployed on compromised servers.
Also Known As
Kaiten, Muhstik
How It Spreads
- • Web application vulnerabilities
- • SSH brute force
- • Container escape
What It Does
- • DDoS attacks
- • IRC-based C2
- • Cryptocurrency mining
- • Backdoor access
Is your business exposed?
Target Platforms
Linux
Detection Tips
- • Monitor for IRC C2 traffic
- • Check for DDoS-related processes
- • Analyze mining activity
- • Review web server logs
MITRE ATT&CK Techniques
T1190, T1110, T1498, T1071
If You're Infected
- 1.
Remove Tsunami from systems
- 2.
Patch exploited vulnerabilities
- 3.
Block IRC C2 channels
- 4.
Review container security
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required