PumaBot

What it is

PumaBot is a botnet program written in Go that takes over internet-connected Linux devices, notably traffic cameras and surveillance systems. It installs a cryptocurrency miner and swaps pam_unix.so, the part of Linux that checks passwords when you log in, for a copy that saves the password of everyone who logs in successfully. It keeps itself running with system services disguised as Redis and MySQL. Because the login check itself has been replaced, a device with PumaBot can't be trusted to check itself.

How it gets in

By guessing weak SSH passwords on devices reachable from the internet.

Close the door: Audit /etc/systemd/system regularly for misspelled or duplicate services and for binaries in non-standard locations such as /lib/redis; review authorized_keys files for unknown keys; monitor for atypical SSH logins and restrict exposure of port 22.

How to tell if you have it

Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.

These commands only look. They change nothing.

Look for the known file locations

sudo ls -la /etc/systemd/system/mysqI.service /etc/systemd/system/networkxm.service /etc/systemd/system/redis.service /lib/redis /usr/bin/con.txt /usr/src/bao/networkxm 2>/dev/null

Search for the known file names (slow on big disks)

sudo find / -xdev \( -name 'jierui' -o -name 'ddaemon' -o -name 'networkxm' -o -name 'pam_unix.so_v131' -o -name 'con.txt' \) 2>/dev/null

Look for the known process names, and where each one runs from

for p in $(pgrep -f 'redis|xmrig|networkxm'); do echo "$p $(sudo readlink /proc/$p/exe)"; done

List running programs that live in a temporary folder (real software almost never does)

sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'

Check the known startup entries, wherever they are installed

systemctl list-unit-files --no-pager 2>/dev/null | grep -F -e 'redis' -e 'mysqI' -e 'networkxm' -e 'my_daemon'; sudo ls -la /etc/init.d/redis /etc/init.d/mysqI /etc/init.d/networkxm /etc/init.d/my_daemon 2>/dev/null

How sure these signs are: The swapped login file keeps the real name pam_unix.so, so a check on the device can't prove it clean. Several names copy real software: redis.service may belong to a real Redis install (the sign is a service that runs /lib/redis), mysqI.service uses a capital I in place of the l in mysql, and redis, xmrig and con.txt are common names. /usr/bin/con.txt is where the captured passwords are written, and it is deleted afterwards, so not finding it proves nothing. The attacker's SSH key listed above is a strong sign in any authorized_keys file. No SHA-256 fingerprints have been published. All these signs come from one 2025 report.

How to deal with it

Removing it in place isn't safe. Here is what to do instead, in order:

1. Don't try to clean it in place. Plan to rebuild the device from a fresh install.
2. Cut the device off from the internet, but keep a way to reach it locally. Save evidence: /lib/redis, the redis.service, mysqI.service, networkxm.service and my_daemon.service files in /etc/systemd/system, /usr/src/bao/networkxm, your authorized_keys files and the installed pam_unix.so. If you can, collect them from a rescue disk.
3. Copy off your data. Don't copy programs, systemd services, authorized_keys files or login files such as pam_unix.so; any of those could bring it back.
4. Reinstall from a fresh, known-good image, install all updates, then restore only the data you copied and checked.
5. From a clean computer, treat every password used on the device as stolen, both local and SSH: change them and cancel the old ones. Remove the attacker's SSH key from any other machine that trusted it.
6. Before you reconnect, don't leave SSH (port 22) open to the internet, and use strong passwords. Regularly check /etc/systemd/system for misspelled or duplicate services and authorized_keys files for keys you don't know, and watch for unusual SSH logins.

What Minaki Scan does about it

Related threats

Sources

This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.

• SP 800-83 Rev. 1, Guide to Malware Incident Prevention and Handling for Desktops and Laptops, NIST (2013-07)
• PumaBot: Novel Botnet Targeting IoT Surveillance Devices, Darktrace (2025-05-28)