Do Son 
At a Glance
| Malware family | Gafgyt / BASHLITE variant (DDoS bot) |
| Threat actor | Unattributed; banner references handle “rimasuta” |
| Targets | Internet-exposed Langflow AI servers (x86_64 Linux) |
| Delivery vector | RCE via Langflow code validation API (CVE-2025-3248) |
| Key capabilities | UDP, TCP, HOLD, and junk/STD network floods |
| Source | Akamai Security Research |
TL;DR
Akamai found a new Gafgyt botnet campaign that hijacks AI infrastructure. Attackers exploit a Langflow remote code execution flaw to drop a stripped-down DDoS payload. The bot drops cryptominers and persistence to focus only on network flooding.
Delivery
Langflow is a visual framework for prototyping AI and LLM applications. Some endpoints run custom code by design. Attackers turned that feature into a weapon. According to Akamai’s research, the code validation endpoint executes untrusted Python “without proper sandboxing.” Injected code then pulls a Linux binary from a remote staging server and runs it from a temporary directory.
Infection Chain
The exploit fetches an x86_64 executable, marks it runnable, and launches it. On startup, the binary forks a child process, then the parent exits. It detaches from the terminal to run quietly. Notably, it prints a taunting banner naming security journalist Brian Krebs. As Akamai puts it, this “isn’t a generic, copy-and-paste script-kiddie payload.”
Command-and-Control and Behavior
This Gafgyt botnet variant hides its C2 traffic with a modified RC4 stream cipher. The scheme changes the S-box seed, adds a two-phase key schedule, and scrambles keystream bytes. Consequently, standard automated decoders struggle to read the traffic. The bot carries no cryptominer, no persistence, and no lateral movement code. Its whole design targets one job: flooding. Four attack modes map to UDP, TCP, HOLD, and junk floods.
Defense and Detection
First, patch Langflow to a release that fixes the code validation flaw. CISA added CVE-2025-3248 to its KEV catalog in May 2025, and GreyNoise has tracked hundreds of exploit source IPs. Next, apply strict egress filtering and block unusual outbound ports. Isolate AI development environments behind a WAF. Finally, deploy YARA rules that hunt for the unique cipher S-box seed bytes Akamai documented. Treat these prototyping platforms as untrusted, not special.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
