New Kairos Botnet Targets Linux Systems
The Go-based malware overwhelms server connection capacity using persistent, idle TCP sessions.
Updated on Oct. 30, 2026 in Cybersecurity
Live Poll
Do you trust that your internet-connected devices are secure from being hijacked by botnets?
Researchers at Nozomi Networks Labs have identified Kairos, a new Go-based DDoS botnet targeting Linux systems. This research-stage threat hijacks compromised devices to overwhelm target servers using high volumes of idle TCP connections.
Why it matters
The emergence of this botnet highlights a continued trend of malware authors leveraging the Go programming language to craft efficient, cross-platform tools for network-layer exhaustion attacks.
The malware utilizes three distinct builds identified through honeypot telemetry. It operates by exhausting a victim's connection capacity through thousands of idle TCP sessions.
The players
Nozomi Networks Labs
A cybersecurity research division focused on threat intelligence, vulnerability discovery, and monitoring of industrial and IoT network ecosystems.
The details
Kairos is written in Go, a compiled programming language favored for its concurrency primitives and ease of cross-compilation across architectures. The malware functions by establishing high volumes of idle Transmission Control Protocol (TCP) connections, a standard transport layer protocol used for reliable data transmission, to rapidly consume the maximum concurrent connection limit of a target server. It receives instructions through hard-coded Command and Control (C2) addresses to manage the network of compromised Linux nodes.
Timeline
October 30, 2026: Researchers documented the discovery of the Kairos botnet.
The Tech Race
Kairos adds to a growing catalog of Go-based botnets that mirror the modularity and persistence once dominated by C or Python-based threats. This development reflects the ongoing shift toward Go in malware development due to its capability to build lightweight binaries that are highly portable across diverse Linux environments.
Network administrators and operators of Linux-based infrastructure should verify that server connection limits are configured to mitigate idle connection exhaustion attacks. There is currently no public patch or indicator of compromise list released for this specific botnet.
The takeaway
The Kairos botnet demonstrates that even well-understood attack methods like TCP exhaustion remain effective when paired with modern, portable languages like Go. Defenders should monitor for spikes in idle TCP traffic patterns to identify nodes potentially hijacked by this botnet.
Further reading
Learn more about evolving threat vectors in the Cybersecurity section.
Source note: This article includes information reported by IT Security News - cybersecurity, infosecurity news.
Live Poll
Do you trust that your internet-connected devices are secure from being hijacked by botnets?
