minaki scan
Menu

Threat wiki / Tsunami

Tsunami

Also known as Kaiten.

Tsunami, also called Kaiten, is an old, openly published bot program. It lets an attacker control a Linux server or device through a chat channel (IRC), mostly to flood other sites with traffic on command.

Documented from public research, not yet tested by us. These steps come from published security research. We have not run them against this threat ourselves yet. This page changes when we do.

What it is
Botnet
Goes after
Linux servers and IoT devices
Verdict
Can be removed with care
Testing
Documented from public research, not yet tested by us
Minaki Scan
Doesn't check for it by name yet
Caught by our sensors
Not yet
Last reviewed
15 Oct 2026

What it is

Tsunami, also called Kaiten, is an old, openly published bot program. It lets an attacker control a Linux server or device through a chat channel (IRC), mostly to flood other sites with traffic on command. Many groups reuse it, so versions differ. In a 2023 campaign the attackers installed a cryptocurrency miner, a second bot written in Perl, and tools to wipe log files alongside it.

How it gets in

In the 2023 campaign, by guessing weak SSH passwords on servers open to the internet.

Close the door: Use long unique passwords or, better, public-key SSH authentication for exposed accounts, keep systems patched, and restrict SSH access with a firewall to trusted networks. Confirm a second working key session before reloading sshd.

How to tell if you have it

Signs published for this threat. One sign alone proves little: names get reused, and newer versions change them. Look for several together.

KindSign
File location/etc/rc.local
File location/etc/rc.d/rc.local
File location/etc/rc.conf
Process name[kworker/0:0]
Process namecrond
Process namemaster

These commands only look. They change nothing.

Look for the known file locations

sudo ls -la /etc/rc.conf /etc/rc.d/rc.local /etc/rc.local 2>/dev/null

Look for the known process names, and where each one runs from

for p in $(pgrep -f 'crond|master'); do echo "$p $(sudo readlink /proc/$p/exe)"; done

List running programs that live in a temporary folder (real software almost never does)

sudo ls -l /proc/[0-9]*/exe 2>/dev/null | grep -E '/(tmp|var/tmp|dev/shm)/'

How sure these signs are: It disguises itself with names real Linux uses, such as [kworker/0:0], crond and master, so those names prove nothing alone: check where each process runs from. It starts itself through /etc/rc.local, /etc/rc.d/rc.local or /etc/rc.conf. Those are normal files, so look for an added line you don't recognise. No SHA-256 fingerprints have been published for it. Don't confuse it with an unrelated Windows program that is also called Tsunami.

How to remove it by hand

Work through these in order. Don't skip the first two.

  1. Cut the server off from the internet, but keep a way to log in, such as your hosting provider's web console. Save evidence first: the process list with where each process runs from, open connections, the startup files named above, and every ~/.ssh/authorized_keys file.
  2. Find the bot by where it runs from, not by its name. For each suspect process number, run sudo readlink /proc/NUMBER/exe. A real kworker has no program file behind it; one that does is suspect. Stop confirmed processes with sudo kill NUMBER, and use kill -9 only if that doesn't work.
  3. In /etc/rc.local, /etc/rc.d/rc.local and /etc/rc.conf, keep a backup copy, then delete only the lines you didn't add. Don't delete the whole file.
  4. In every ~/.ssh/authorized_keys file, remove keys you don't recognise and keep your own. Researchers report the attackers can come back through an SSH backdoor even after the bot is deleted, so also look in /etc/passwd for accounts you didn't create.
  5. Move the bot's program file into a folder only root can read, then delete it once you've finished collecting evidence. Look for the other tools from the 2023 campaign too, the miner, the Perl bot and the log wipers, and check your logs for gaps.
  6. If the attacker had full control (root), or you can't confirm what changed, rebuild from a fresh install and restore only data you've checked.
  7. From a clean computer, change the passwords and SSH keys that were on the server. Switch SSH to key logins, allow SSH only from addresses you trust, then restart and check again.

These steps are provided as-is, without warranty. Run them at your own risk, and back up first. If you're unsure, rebuild from a known-good install.

What Minaki Scan does about it

Minaki Scan does not remove this threat yet. Its general checks may still flag what it leaves behind.

Minaki Scan checks your server for this and every other threat in this wiki, explains each finding in plain English, and never changes anything without your OK. $1 per server a month. Downloads open soon.

Sources

This page is written by MinakiLabs in our own words. The facts above come from this published research; credit and thanks to its authors.