Tracking the IoT botnet's bloodline: code footprints don't lie

Tracking the IoT botnet's bloodline: code footprints don't lie

Speakers: Chanbin Jeon (Analyst, SANDS Lab), ChangGyun Kim (SANDS Lab), SeungBeom Lim (SANDS Lab)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=dJ-ZS9pPNss

Overview

The proliferation of Internet of Things (IoT) devices has ushered in a new era of security challenges, making them prime targets for sophisticated botnets. This talk, presented by the SANDS Lab team at Virus Bulletin, delves into a novel approach for understanding and tracking the evolution of these pervasive threats. Titled "Tracking the IoT botnet's bloodline: code footprints don't lie," the presentation introduces DVPL (Deep Variant Profiling and Lineage), an automated system designed to construct lineage graphs of IoT malware by analyzing the reuse and modification of malicious functions.

The core premise of DVPL lies in the idea that even as malware evolves and mutates, its fundamental malicious functionalities often persist, leaving identifiable "code footprints." By leveraging advanced techniques such as Large Language Models (LLMs) for function filtering and embedding models for similarity calculations, DVPL aims to overcome the limitations of manual analysis, which struggles to keep pace with the sheer volume and rapid evolution of IoT-based attacks. The SANDS Lab team, with their focus on North Korean threat actors, highlights the critical need for such automation to combat increasingly complex and frequently variant threats targeting South Korea and beyond.

This presentation is particularly relevant for threat intelligence analysts, incident responders, and security researchers grappling with the escalating threat landscape of IoT botnets. It provides a robust methodology for automatically profiling threats, distinguishing new variants from established families, and visually mapping their evolutionary paths. The ability to trace the "bloodline" of a botnet not only aids in attribution and understanding adversary tactics but also empowers defenders to anticipate future mutations and develop more resilient countermeasures.

Background

▶ Watch: Introduction: IoT Botnet Bloodline & Code Footprints (0:00)

The landscape of cyber threats has seen a significant shift towards IoT-based attacks, presenting unique challenges due to the sheer number of devices, their inherent security vulnerabilities, and the increasing ease of generating new variants. SANDS Lab, a prominent threat intelligence platform, primarily focuses on tracking and analyzing attacks originating from North Korea, many of which have increasingly leveraged IoT devices. Specific North Korean threat actors like Lazarus and Kimsuky have been identified as actively employing IoT attacks against South Korean targets.

The history of significant IoT botnets underscores the urgency of this research. The notorious Git botnet first emerged in 2014, followed by the devastating Mirai botnet in 2016, which launched massive Distributed Denial of Service (DDoS) attacks. More recently, in 2022, Mirai variants and the Gapsid botnet were implicated in attacks targeting Ukraine. The trend continues into 2023 with the emergence of new IoT botnet variants like Kaden. This continuous evolution highlights a critical vulnerability: IoT devices often lack robust security mechanisms, making them attractive targets. Furthermore, the advent of Large Language Models (LLMs) has simplified the process for attackers to generate novel malware variants, accelerating the pace of threat evolution.

Traditionally, threat analysts rely on manual analysis to produce high-quality threat intelligence reports. However, this approach is inherently inefficient and costly when confronted with the high volume and rapid mutation rate of IoT malware. The scale of IoT attacks makes it impractical for human analysts to manually track every new variant, identify its origins, and understand its relationship to known families. This bottleneck necessitates the development of automated threat profiling tools that can support analysts by efficiently processing and correlating vast amounts of malware data, thereby enabling them to focus on strategic insights rather than repetitive analytical tasks. The demand for such automation is further amplified by the exponential growth in deployed IoT devices, whose security capacity often lags significantly behind other networked systems.

Key Findings

▶ Watch: Function Hash: Accelerating Malware Similarity Calculation (8:20)

The central contribution of this talk is the introduction of DVPL (Deep Variant Profiling and Lineage), an innovative automated system designed to trace the evolutionary "bloodline" of IoT botnets. DVPL addresses the critical need for efficient and consistent threat profiling in the face of rapidly evolving malware. The system's core functionality revolves around identifying and analyzing code footprints, specifically malicious functions, to construct detailed lineage graphs that illustrate the relationships between different malware samples.

DVPL's architecture integrates several key technologies to achieve its objectives:

1. Function Filtering with LLMs: Large Language Models are employed to meticulously filter and label functions within decompiled malware binaries, distinguishing between malicious, normal, and system functions. This ensures a consistent and objective initial classification, overcoming the variability inherent in manual analysis.
2. Similarity Calculation with Embedding Models: Malicious functions identified by the LLM are then converted into numerical embedding vectors using an embedding model. This transformation allows for the precise calculation of similarity between functions, a crucial step for identifying code reuse.
3. Efficient Similarity Search with Function Hashing (fash): To address the computational challenges posed by high-dimensional embedding vectors and large function databases, DVPL introduces a novel technique called function hashing (fash), based on vector continuation. This significantly reduces the search space and accelerates the similarity comparison process, making it feasible for real-time analysis.

The system's output is highly valuable for threat analysts, providing a JSON file detailing similar files with confidence scores, an interactive lineage graph visualization, and crucially, the actual C code snippets as evidence. DVPL can automatically distinguish between entirely new threats and variants of existing families, quantify code reuse rates, and measure similarity scores. A significant finding demonstrated during the talk was DVPL's successful application in tracing a real-world, newly detected sample – an x86 Rebus Reborn variant – back through its evolutionary path to the well-known Gapsid family, and further tracking its commercial rebranding as Eternal Stresser. This validation against SANDS Lab's existing campaign tracking data underscores DVPL's accuracy and practical utility in reconstructing botnet evolution and actor ecosystems.

Technical Deep Dive

▶ Watch: Real-world Validation: Tracing a Gaps Family Sample (12:00)

The DVPL (Deep Variant Profiling and Lineage) system is engineered to provide an automated, in-depth analysis of malware, focusing on identifying code reuse at the function level. The process begins with binary decompilation, where a target malware file is converted into its equivalent C code representation. This step is crucial as it transforms the raw binary into a human-readable and analyzable format.

Following decompilation, the C code is subjected to pre-processing, which involves dividing it into individual functions. Each function then undergoes a critical filtering and labeling stage facilitated by Large Language Models (LLMs). The rationale behind using LLMs here is to achieve consistent and objective labeling. Unlike human analysts whose results might vary based on skill, experience, or tools, an LLM provides uniform classifications. This process labels each function as either "normal," "malicious," or a "system function." The speed of LLM-based labeling also significantly surpasses manual efforts, enhancing efficiency.

Once functions are categorized, specifically the "malicious" ones are selected for the next stage: embedding. Here, an embedding model transforms the C code of these malicious functions from textual data into high-dimensional numerical vectors. This conversion is fundamental because it allows for mathematical operations, particularly the calculation of similarity, between different functions. Textual comparison alone is challenging and often imprecise for identifying semantic similarities, but vector space enables robust distance metrics.

A significant challenge arises from the high dimensionality of these embedding vectors. Comparing every function vector in a target file against every function vector in a vast database of known malware can be computationally intensive and slow, especially as the database grows. To address this, DVPL introduces function hashing (fash), a technique based on vector continuation. This method effectively reduces the search space for similarity comparisons. Instead of calculating similarities across the entire database, fash narrows down the potential matches to a more localized region around the target function's hash. The presentation graphically illustrates that without fash, computation time increases rapidly with the number of functions in the database. However, with fash, the time complexity remains at a near-constant level, making the system scalable and efficient for large-scale analysis.

The culmination of this technical process is the generation of actionable threat intelligence. DVPL outputs a JSON file that details similar files found in its database, along with a confidence score for each match. This data is then used to construct an interactive lineage graph. This graph visually represents the relationships between malware samples, where nodes are samples and edges indicate similarity, often with associated confidence levels. Analysts can click on nodes within the graph to inspect the specific functions that were deemed similar and view their corresponding C code, providing concrete evidence for the observed code reuse and evolutionary links. This comprehensive output empowers threat analysts to swiftly understand the provenance and evolution of new malware samples, greatly enhancing their ability to respond to emerging threats.

Demo / Proof of Concept

▶ Watch: Campaign Tracking: Rebos/Demon/Eternal Stresser Timeline (20:30)

The talk presented a compelling demonstration of the DVPL system's capabilities by tracing the lineage of a real-world IoT botnet sample. The scenario began with an alert from SANDS' threat collection system, indicating a newly discovered malware sample not yet present in the DVPL database. The critical question for the analysts was its origin: "Who is it derived from?"

The initial analysis using DVPL rapidly profiled the sample, identifying it as a Linux target backdoor with an 84.79% chance of belonging to the notorious Gapsid family. However, DVPL didn't stop at a high-level classification. It proceeded to perform a detailed function embedding-based analysis to establish the exact lineage. By comparing similar functions across its database, DVPL automatically generated a lineage graph that visually mapped the sample's evolutionary path.

A key aspect of the demonstration involved showing how DVPL identifies code reuse and modifications at a granular level. For instance, two files were shown to be "tightly linked" with a 99% similarity, forming a direct connection in the graph. A deeper dive into specific functions revealed intricate details:

• Main Function Similarity: The embedding similarity of the main function was consistently high across related samples, indicating a shared core.
• Demonization Routine: Direct comparison of the pseudocode revealed that the prologue of the demonization routine remained identical across generations. This critical initial setup for backgrounding the malware was preserved.
• C2 Communication Evolution: While the core logic of command-and-control (C2) communication persisted, specific elements evolved. For example, initial communication messages changed from joined rebus S to join rebus S. Similarly, socket names used for communication evolved from CEO socket to rebus socket, and later from a custom socket to the more generic main com sock associated with Gapsid.
• Functional Logic with String Changes: The demonstration highlighted how DVPL can track logical evolution even when superficial strings change. For instance, the C2 communication logic progressed from rebus to rebus reborn, and then to demon boy file. Despite changes in identifier strings, the underlying malicious logic remained consistent, allowing DVPL to establish continuous connections.
• Hexo Attack Replacement Routine: A specific example of code evolution was shown in the hexo attack replacement routine. While the function flow and application logs were identical, the dummy data and patterns used within this routine changed across generations. Demon v1 used generic dummy patterns, Demon v5 employed random strings, Rebus used randomized exploit patterns, and Rebus Reborn incorporated a specific bash poke bomb string. These granular code differences, alongside functional similarities, strongly indicated a single family lineage.

The tracing process successfully reconstructed the lineage from the newly detected x86 Rebus Reborn sample, back through Rebus, Demon V5, and Demon V1. The power of DVPL was further validated by comparing its automatically generated lineage graph with SANDS Lab's manually tracked campaign data. The notes highlighted on the screen showed a perfect alignment, confirming that DVPL's function similarity analysis accurately mirrored the actual campaign flow and evolution observed by human analysts.

The demonstration also presented a summary of the DVPL scores, showing that main function similarity remained high across generations, while C2 function similarity gradually dropped, reflecting its evolutionary changes over time. This quantitative data provides objective evidence for the observed lineage.

Beyond the technical tracing, the talk presented a concise campaign tracking result that contextualized the identified botnet family:

• 2018: Initial Rebus related activity observed.
• 2019: Evidence of Demon samples being distributed and sold.
• 2020: Rebus botnet appears.
• 2021: Commercial promotion of Rebus becomes active.
• 2022: Key events include service outages (September 15) and a full source code sale for Rebus (September 25).
• Early 2023: The operator known as "Cash" activated a personal channel and began rebranding to Eternal Stresser.
• August 2023: The new brand Eternal Stresser was promoted for sales, before the associated account was eventually deleted.
• The Eternal Stresser service was advertised as supporting Layer 3, 4, and 7 attacks, and its C2 console showed strong similarities to the Rebus network C2 console, reinforcing the lineage.
• The x86 sample detected was linked to the Rebus Reborn family, which was found to have spread across communities of Chinese-speaking actors.
• The domain rebus.com, previously promoted in 2022, was observed to reappear in 2025 (a potential future observation or re-emergence), highlighting the persistent nature of these threats.

In summary, the demonstration effectively showcased DVPL's capability to link true malware lineage at the function level, reconstruct complex botnet evolution, and correlate technical findings with real-world campaign intelligence, providing a holistic view of the threat ecosystem.

Defensive Implications

▶ Watch: Conclusion: Reconstructing Botnet Evolution and Ecosystem (24:00)

The DVPL system and the methodology presented by SANDS Lab offer significant implications for cybersecurity defenders, providing advanced tools and insights to combat the escalating threat of IoT botnets.

Firstly, the ability to automatically generate malware lineage graphs is a game-changer for threat intelligence. Defenders can quickly understand the evolutionary path of a new sample, determining if it's a completely novel threat or a variant of a known family. This context is crucial for prioritizing response efforts and allocating resources effectively. Instead of treating every new sample as an isolated incident, analysts can now place it within a larger family tree, leveraging existing knowledge about the parent botnets.

Secondly, DVPL's focus on code footprints (malicious functions) provides a robust mechanism for variant detection. Even when botnet operators modify superficial elements like strings or C2 addresses, the underlying malicious functions often remain similar. By tracking these core functionalities, defenders can develop more resilient detection signatures that are less prone to evasion by minor obfuscation techniques. This shifts the defensive paradigm from signature-based detection (which can be easily bypassed) to behavior and function-based detection, which is more enduring.

Thirdly, the system aids in adversary attribution and tracking. As demonstrated with the Rebus/Eternal Stresser lineage, DVPL can link seemingly disparate campaigns and rebranding efforts back to core codebases and, by extension, to specific threat actor groups (e.g., North Korean APTs, Chinese-speaking actors). Understanding the "bloodline" of a botnet contributes to a clearer picture of the actors' TTPs, their development cycles, and their preferred exploitation methods, enabling more targeted intelligence gathering and proactive defense strategies.

Fourthly, the detailed technical deep dive into code reuse and modifications, including specific changes in C2 communication messages, socket names, and exploit patterns, provides actionable intelligence for incident response. If a defender identifies a variant, they can quickly pinpoint the likely C2 infrastructure or attack methods based on the lineage. For example, knowing that a bash poke bomb string is associated with a specific variant can inform network defense rules or host-based intrusion detection systems.

Finally, the talk implicitly highlights the need for automated defense mechanisms to counter the ease with which attackers can generate new variants using tools like LLMs. As attackers leverage AI to accelerate their development, defenders must also adopt AI-driven solutions like DVPL to keep pace. This includes integrating such lineage tracking into existing security operations centers (SOCs) to enhance automated triage, correlation, and response capabilities. By understanding the functional evolution of threats, defenders can anticipate future mutations and build more adaptive security architectures.

Key Takeaways

• IoT botnets are an escalating and evolving threat: Driven by the proliferation of insecure IoT devices and the ease of generating variants with LLMs, sophisticated botnets like Mirai, Gapsid, Rebus, and Eternal Stresser pose significant and persistent risks, requiring advanced tracking methods.
• Manual malware analysis is insufficient for modern threats: The high volume and rapid mutation rate of IoT malware render traditional, human-centric analysis inefficient and costly, creating a critical need for automated threat profiling tools.
• DVPL leverages AI for automated lineage tracking: The Deep Variant Profiling and Lineage (DVPL) system employs Large Language Models (LLMs) for consistent function filtering and embedding models for precise similarity calculations to automatically construct malware lineage graphs.
• Function hashing (fash) ensures scalability and efficiency: To overcome the computational challenges of high-dimensional vector comparisons, DVPL utilizes function hashing, which significantly reduces the search space and maintains constant time complexity even with large malware databases.
• Code footprints accurately reveal botnet evolution: By analyzing the reuse and modification of core malicious functions and providing C code evidence, DVPL successfully reconstructs the true evolutionary path of botnets, validated by real-world campaign data from the Rebus/Eternal Stresser family.
• Automated lineage analysis empowers defenders: DVPL provides crucial insights for threat intelligence, variant detection, and actor attribution, enabling defenders to understand botnet bloodlines, anticipate future mutations, and develop more targeted and resilient defensive strategies.

About the Speaker(s)

The talk was presented by a team from SANDS Lab, a threat intelligence platform based in South Korea, demonstrating their expertise in advanced security research. Chanbin Jeon served as an Analyst at SANDS Lab, contributing to the detailed analysis and validation of the DVPL system. ChangGyun Kim and SeungBeom Lim are members of the AI team at SANDS Lab, highlighting the organization's focus on leveraging artificial intelligence for cybersecurity challenges. Their collective work at SANDS Lab emphasizes a strong commitment to tracking and understanding complex cyber threats, particularly those originating from North Korean actors and targeting IoT infrastructure.