Multi-Architecture BBNet Linux Botnet Pairs Divergent Scanners With React and Telnet Exploits
Do Son 
Startup, scanning, controller communications, and update paths in the x86-64 payload | Image: PRODAFT
At a Glance
| Malware Family | BBNet Linux botnet (META payload v3.0; 13 ELF binaries across 10 unique SHA-256 hashes using .bbnet local artifacts) |
| Threat Actor | Unattributed operator (package recovered from an exposed directory; no confirmed or suspected actor attribution) |
| Target / Victims | Linux hosts, routers, IP cameras, and React Server Components deployments across ARM, AArch64, x86, MIPS, and PowerPC (0 confirmed victim counts supplied in package) |
| Delivery Vector | Autonomous Telnet brute-forcing and 11 exploit handlers (including CVE-2025-55182 and CVE-2026-24061) fetching the infect.sh loader script |
| Key Capabilities | Pre-C2 autonomous scanning, 11 embedded exploit routines, 7 TCP/UDP DDoS worker modes, crontab and rc.local boot persistence, HTTP build updates |
TL;DR
PRODAFT researchers analyzed a multi-architecture BBNet Linux botnet package recovered from an exposed server directory in November 2026. Containing 13 statically linked ELF binaries across 10 unique hashes, the BBNet Linux botnet splits its scanning logic between a local Telnet spreader on x86-64 and an 11-exploit scanner across 12 other builds. Notably, the malware starts scanning for new victims before connecting to its command server, meaning simple C2 blocks will not halt propagation.
Delivery and Attribution
In November 2026, the PRODAFT Threat Intelligence team obtained a 28-file distribution archive totaling 13.65 megabytes from an open directory. Inside the package, analysts found one shell loader script named infect.sh, 14 text build markers, and 13 unstripped ELF binaries compiled for ARM, AArch64, x86, MIPS, and PowerPC systems. Deduplication revealed 10 unique binaries because three filename pairs – including the little-endian MIPS and Ubiquiti-labeled builds – were byte-identical.
Attribution and Victim Scope
Neither confirmed attribution nor suspected attribution applies to a named threat actor in this investigation. Although the startup banner prints “META payload” with version 3.0 and drops hidden files carrying a .bbnet prefix, researchers use the BBNet label strictly to group the artifacts rather than to claim links to an established group. Similarly, while the scanner targets routers, network cameras, Telnet ports, and server-side React apps, the recovered archive contained no victim telemetry. As the PRODAFT technical report states, “Sample-derived counters and command acknowledgments cannot establish deployed population, successful exploitation, or attack impact.”
Infection Chain
When a vulnerable device receives a loader command, it requests infect.sh and steps through writable folders starting with /tmp, /var/tmp, /dev/shm, and /var/run. Using 12 download variations across wget, curl, BusyBox, Toybox, FTP, and TFTP, the script pulls all 13 architecture binaries one by one, saves each candidate as .b, and runs it without checking the host CPU first.
Divergent Scanners and 11 Exploit Handlers
Upon launch, the binary detaches via a double fork, copies itself to /etc, /var/lib, or /tmp as .bbnet, and writes reboot entries into /etc/crontab and /etc/rc.local. Crucially, the reboot entries omit runtime server arguments, forcing restarted bots back to their compiled default C2 settings. Before contacting the command server, the main process spawns a child scanner process.
Here, the multi-architecture BBNet Linux botnet divides into two distinct branches. The x86-64 binary spawns 16 worker threads that scan local /24 interface subnets on TCP ports 23 and 2323 using 20 credential pairs, verifying access with a SHELL_TEST echo check. In contrast, the other 12 filenames use an expanded scanner traced in the i686 build. This branch spawns 24 threads, uses a 45-pair credential table, and dispatches 11 exploit handlers. Alongside router and camera flaws in Hikvision, D-Link, Netgear, GPON, Huawei, and Realtek devices, the scanner targets CVE-2026-24061 (GNU Inetutils Telnet NEW-ENVIRON argument injection) and CVE-2025-55182 (React Server Components multipart deserialization remote code execution).
However, PRODAFT discovered that the shared HTTP helper marks an exploit attempt as a “hit” as soon as the request finishes sending, without checking whether the target executed the command. Because an early positive return causes the worker to skip remaining handlers on port 80, internal hit statistics overstate real infections.
Command-and-Control and Traffic-Generation Behavior
After starting the scanner, the parent process connects over plaintext TCP (defaulting to port 7778) and sends a BOT registration string containing a random 24-character hex ID, architecture, OS, hostname, and version. Meanwhile, an HTTP updater checks port 7779 for 16-character build markers and stages replacement binaries at .bbnet.new without verifying cryptographic signatures or file hashes.
Through text commands such as HOME, HOMEWAVE, HOMEBYPASS, and PPS, operators direct seven internal flooding modes. These workers generate direct UDP and TCP traffic using standard kernel sockets. For example, the routine named run_syn_until simply opens nonblocking stream sockets, calls connect, and closes the descriptor, rather than crafting raw spoofed SYN packets.
Defense and Detection Guidance
Because the BBNet Linux botnet launches its scanner child process before registering with its controller, firewall blocks against the C2 server will not stop an infected host from scanning peers. As the report warns, “Propagation starts before controller registration. Blocking a controller connection does not necessarily stop an already running scanner. Containment must address the scanner process, peer reachability, and payload distribution paths together.”
Defenders should hunt for hidden .bbnet executables inside /etc, /var/lib, and /tmp, alongside temporary staging and state files such as .bbnet.new, .bbnet_scan_on, and .bbnet_scan.stats. Administrators must also audit /etc/crontab and /etc/rc.local for unauthorized @reboot entries, patch React Server Components (CVE-2025-55182) and GNU Inetutils Telnet daemons (CVE-2026-24061), and disable exposed Telnet services across all Linux and embedded hosts.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
