CNCERT Warns of FlyLegit Botnet Spreading on Linux and IoT Devices

CNCERT and NSFOCUS report that the FlyLegit botnet is spreading on Linux servers and IoT devices and using them for DDoS. Since late 2025 the family has cycled versions and about 40 C2 nodes, with roughly 2,015 confirmed active bots in China during 3-8 September 2026.

This report is jointly issued by the National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT) and NSFOCUS Technologies Group Co., Ltd.

Overview

CNCERT and NSFOCUS report that the FlyLegit botnet continues to spread on Linux servers and IoT devices and then uses those hosts for DDoS. The family entered monitoring in late 2025 and has kept shipping new versions. It now poses a substantial threat to exposed devices.

The name comes from the operators' Telegram group t.me/flylegit, which they use to advertise the service. Compared with botnets built only for DDoS, FlyLegit also supports self-update, bind shell, and reverse shell. Infected devices can serve as a foothold for later stages and extra malware.

To date, researchers have captured 68 download hosts and 900 URLs used to fetch architecture-specific binaries. Coverage includes seven architectures: x86, x64, arm, mips, mipsel, sh4, and ppc. Forty C2 nodes have been identified. Operators replace about five C2 nodes per month. From 3 to 8 September 2026, confirmed active bots in China numbered about 2,015, with a single-day peak of 427 check-ins.

Propagation and infrastructure

Delivery

FlyLegit spreads mainly through Telnet weak-password scanning and vulnerability exploitation, including Realtek CVE-2018-10561. Dropped binaries use the naming pattern iran plus an architecture tag, for example iran.x86_64. Download scripts are often named cat.sh. Those scripts select among architectures such as x86_64, mips, and arm, then fetch the matching binary with wget or curl.

The malware is launched with optional arguments that have included telnet, catloader, empty values, shell-style argument passthrough, and a Default/no-argument mode. Later samples reuse those values when building check-in data.

Figure 1. FlyLegit capabilities and attack chain

Download nodes

Since late December 2025, 68 download addresses and 900 architecture-specific URLs have been collected. Operators change download hosts about once a week and keep the iran-plus-architecture file names. Monitoring indicates the botnet is still being maintained and expanded.

Figure 2. FlyLegit monthly new download addresses

C2 distribution

From late December 2025 through the report date, 40 C2 nodes were captured across nearly 10 countries, with Germany at 43 percent and the Netherlands at 28 percent. C2 rotation is frequent, about five nodes per month. After a change, operators often reuse ports, including 7080, 8060, and 7777. Hosting is concentrated on small and mid-size European providers.

Figure 3. FlyLegit C2 geographic distribution

Sample tactics

Version changes

Supported commands have shifted by version. The first build handled six DDoS modes. From January to June 2026 some builds cut commands and flood types. From July 2026 samples restored multiple DDoS commands and added Telnet scanning plus Realtek-related vulnerability scanning. Aside from ping, command evolution is as follows.

| Period | Version | Routine commands | DDoS commands | Scan commands | | --- | --- | --- | --- | --- | | 2025.12-2026.01 | V1 | kill, stop, update | tcp flood, syn flood, http flood, udp flood, udpplain flood, icmp flood | none | | 2026.01-2026.04 | V2 | kill, stop | syn flood, udpplain flood | none | | 2026.05-2026.06 | V3 | kill, stop | syn flood, udpplain flood | none | | 2026.07-2026.08 | V4 | kill, stop, update | tcp flood, syn flood, http flood, udp flood, udpplain flood, icmp flood, gre flood | selfrep telnet, selfrep realtek |

Persistence and competition

FlyLegit persists through /etc/init.d and /etc/rc.local so it returns after reboot. It also kills competing malware to hold the host. Some early versions encrypted C2 traffic with ChaCha20. The latest versions use plaintext.

Command and control

C2 activity covers check-in, heartbeat, and command delivery. Check-in data include an architecture name and a group field that marks campaign batches. The default group is default. If a launch argument is present, that value is written into group.

Heartbeat uses ping and pong. The bot replies to ping with pong plus architecture. Commands are strings in key=value form and can set flood size, source IP, and ports. Some versions encrypt C2 commands with ChaCha20. Those builds carry an initial key, and the nonce needed to decrypt sits at the start of the sent data.

Core capabilities

Core functions are self-update, DDoS, and shell command execution. The !update command fetches a new binary over HTTP GET from a hardcoded address, prefers /tmp, and falls back to /var, /dev/shm, or the current directory if needed, then sets execute permission.

Observed DDoS command names and effects:

| Command | Method | Notes | | --- | --- | --- | | tcp | TCP flood | Multiple TCP handshakes; random data | | syn | SYN flood | Crafted SYN packets; can target a netblock; fixed, random, or mixed fill | | udpplain | UDP flood | Can target a netblock; fixed, random, or mixed fill | | udp | UDP flood | Random fill; otherwise same as udpplain | | http | HTTP flood | Multiple TCP handshakes; GET, POST, and HEAD | | icmp | ICMP flood | ICMP_ECHO; can target a netblock; random fill | | gre | GRE flood | Separate config including gre_proto/gport; TCP or UDP; can target a netblock |

The family also supports bind shell and reverse shell:

| Command | Notes | | --- | --- | | !openshell | Bind shell: listen on a chosen port with a password and accept remote shell commands | | !shellcmd | Reverse shell: run a command issued by the operator |

Infection scale in China

From 3 to 8 September 2026, confirmed active FlyLegit bots in China numbered about 2,015. The highest single-day check-in count was 427.

Figure 4. Daily check-in counts of FlyLegit bots in China

Mitigation

CNCERT and NSFOCUS recommend:

1. Close unused Telnet, SSH, and device remote-management interfaces. Do not expose management ports on the public internet. 2. Change default passwords. Use strong passwords. Do not reuse one password across devices. 3. Patch the vulnerabilities named in this report. Update device firmware and Linux components. 4. Monitor for abnormal scanning, malware-download requests, C2 connections, and unusual DDoS traffic. 5. If a host is infected, isolate it, keep logs and samples, find the entry point, finish patching and credential rotation, then restore service. 6. For IoT devices that cannot run endpoint protection, use access control, network segmentation, and egress limits.

Indicators of compromise

C2

165.22.247.105:2220 176.65.139.35:7080 85.11.167.182:5855 83.168.110.191:1336 38.60.216.39:13322 94.249.228.212:6767 176.65.139.67:17692 192.109.200.199:23 174.138.43.79:6060 45.156.87.176:7080 134.199.219.57:6060 140.233.190.82:6221 176.65.139.18:7000 130.12.180.85:7080 34.107.120.7:1150 45.153.34.77:6000 64.89.161.81:6667 31.56.120.29:7080 130.12.180.80:7080 87.121.84.11:7080 45.153.34.195:7080 36.255.97.23:7777 167.86.99.169:8060 31.77.227.119:8060 165.22.69.214:3131 94.154.43.88:8060 195.201.123.9:8060 103.83.87.122:8060 176.65.139.51:7080 94.26.106.236:777 176.65.139.121:7080 82.25.63.213:7080 31.56.209.72:621 176.65.139.196:621 176.65.139.161:25596 176.65.139.7:1337 176.65.139.45:6060 176.65.139.36:5555 82.26.74.181:7080 176.65.139.61:5090

Hashes

4de9763c9bdd12fb25f907bcef4144af d02158d0fc4233f9654225a3bfc2ea95 0370683c629a40cc495915161cf3f975 b0b959b1d9c06322391d3b39843a9a07 89d3f3ce6f654953e2cee1101db8de0d 9f16e5596a7d2fa48d7be03a71fdb21b 76ad977cdbf28f1cf82bba1bdf67303c 1dff9725fb3889423d8249e1dadade57 931224bbb764aab452b2a1ae545b3a23 018caecd80077ec3d2a9453270a6a784 4cad9ad790f6d573986497c20ed5dfca 7bb1e14c29188186670478c2bd99fb9b d284088eff26ebf3b192c01abd269fe0 c34b4e4a8958653bdd3b01870b97f87b e362076dd212b2e211638bad035bd997 c0a9a8933607d59f5d5daee74403df05 17303c070fd6660cc0c5ff77aa9ec165 fe45e8d7f7afeae48e9edd2fbdae52c5 870497c8ff0c4ef447dc3989d767834c 67ab69aa3ff21a5deb7bbc5b266306d4 c831f502474dc988bc9b21eee10a3178 2c135e3d6ec2cbf9535b071f09b2576c 1a3461022e05789e226537e18fe3109b 1904a7168d08625d3321d0d0eef80e5a 44b9c9b80a57e83c336e6a5218fabcf2 a9cae0f2350f48350ace1528f3a5be84 70ace99ef8f3b9350063af10303bfd92 dca40f08cc93bc2fba8e3f5fec18593f f2d5837da4ebe93a67ec5b0a8a8507c7 71075cdbcc330b42f0ae68be6ff44ea3 7a9248f3420d8b3d6b94ba346aea6254 0e54628ea332bec9a12705b76a729a0c 62a0e401fcc42c435e66fae9f71d6c10 5d5aeddab8cddb7536ce44dbfd23daef 2b1931ca78a0c1832deb0d154fbd17a1 fc453bc95d34da863f4c3d1cbec45df7 3ce8a714552d621ba5bb10edcb838078 cdeacf6fae101680001237b643b12063 a2913a2ccbe45c273287dd285c0e54e1 15c99f12454b0678ffd6bcdef1a1bb77 1d7f5fe93a49193020ab25f13ae6c170 a83ee62337e4218437d35daa84961324 0f729e7a9bd73eed5759f1a18358650c e36870a89afdc8acb6730da78d831737 b8f998dbf01a5237de323d6cb6b8ea84 1ebf44143d7c2e71bb294fdcd862a1f4 4ba79ef0833c5b390f5a7b29f3bee399 cdffbebdcab69edbe8b42fd15544a1fb b8ae867c8b82e47272e15b23e72df2ce a17d6def8c4db71feb8492db1cb90f6b f226e5066a68f1ff726206c5eafb611f b228d31b6630a892200b4be0a4396c0f 644b654a6bb931d8be34de2d491ecf89 39cbaaf449babd4f6ea1e7525d29deea bb474861b2e5c7a6eb1013b60b416740 45a160258e51e30c74ec313f452dbe89 a108a29b2fdc2918d7e8285c33860394 95353f04087412d8adf9c9c4f01a1fc3 6a27151a55536335f48a54789c3515ac e6ac4beb231201daffbdcd76d8889ebc 3473a76c22c93ab8289360c5770059cf 903d78539ceb95324d6f0f5cdb9c71dc ed06f2ac6907f89a09f8bc5d6988700c 0a553af07ee56bf11694dcb6246e504d 7f0e5f422dec2a152787e38f22851cd2