In July 2026, the threat intelligence team at Palo Alto Networks’ Unit 42 published an unusual analysis. After examining an IoT botnet called TuxBot v3 Evolution, the researchers discovered that large portions of the malicious code did not originate from a human but rather from a language model. The model even left its own train of thought as comments in the code. This is a small detail with great symbolic significance because botnets are currently evolving faster than many security teams can respond.
TuxBot is not an isolated case. It marks the culmination—so far—of a trend that began innocently more than three decades ago.
From Eggdrop to TuxBot: The History of Botnets
IRC bots since 1993
In 1993, Jeff Fisher released Eggdrop, one of the first IRC bots. It was designed to be an administrative tool for chat channels, not an attack tool. However, because users who had been kicked out wanted to retaliate, it led to the so-called IRC wars, which were an early precursor to today’s DDoS attacks.
Bot Construction Kits 2002–2007
In the following years, the field became more professionalized. Between 2002 and 2004, fully-fledged modular systems such as “Agobot,” “SDBot,” and “Spybot” emerged. Their source code circulated openly online, enabling less technically savvy individuals to create their own variants. This was an early precursor to today’s malware-as-a-service models. In 2007, the Storm botnet infected an estimated 50 million computers and was used for spam and identity theft.
IoT Botnets Starting in 2016
As web-based services proliferated, bots moved beyond IRC channels. In 2016, the Mirai botnet marked the next major shift. The malware scanned the internet for Internet of Things (IoT) devices with default factory passwords and launched attacks on an unprecedented scale, including a multi-hour outage at the Domain Name System (DNS) provider Dyn. After the source code was published, an entire family of copycats emerged that remain active to this day.
After that, the focus shifted primarily to stealth. Bots based on Chrome or Chromium mimicked mouse movements and clicks so realistically that they were virtually indistinguishable from real users. Meanwhile, attacks shifted to hijacked home routers, known as residential proxies. Traffic no longer originated from suspicious data centers but from seemingly ordinary households.
Evooo1Bot: The Old Mirai Code Lives On
Although AI is accelerating the development of new attack tools, a recent discovery shows that the ten-year-old Mirai source code is still relevant. Since July 2026, FortiGuard Labs has been monitoring a Linux botnet called Evooo1Bot, which targets routers and other edge devices from manufacturers such as Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link. Evooo1Bot is based on the publicly available Mirai code, but its developers have significantly expanded it.
Evooo1Bot demonstrates that the threat landscape is intensifying not only due to new AI tools, but also due to the evolution of existing code. Even years-old, established code is continuously being refined and augmented with new capabilities, such as proxy abuse. Incidentally, this Mirai lineage is also behind the Aisuru and Kimwolf botnets, which triggered the largest known DDoS attack in late 2025.
Learn more about an easy-to-implement and highly effective WAAP solution.
Everything from a single source, and available as a fully managed service upon request.
TuxBot v3: When AI Becomes a Co-Developer of Malware
Since 2024, generative AI has accelerated this trend on two fronts simultaneously. First, the barrier to entry is lowering. Bot-as-a-Service platforms and AI code generators enable even those with limited technical expertise to develop functional attack tools. Second, AI is changing the development of malware itself, which is precisely where the TuxBot case comes in.
The analyzed framework featured an encrypted command-and-control channel, a domain-generation algorithm, and its own exploit language. The errors were particularly revealing. The language model claimed to have implemented modern Argon2id encryption. However, it relied on a significantly weaker method.
This highlights an important pattern: AI lowers the barrier to developing malware but does not replace expert oversight. Those who rely solely on a language model are building vulnerabilities into their attack tools. Conversely, defenders should not assume that the threat is decreasing. The volume of new malware variants continues to grow.
Figures That Illustrate the New Scale of Bot Attacks
According to recent reports, the number of AI-generated bot attacks increased twelvefold within a single year, rising from around two million to 25 million per day. It is now estimated that more than half of all web requests originate from bots, one-third of which are malicious.
The scale is also growing on the operational side. In late 2025, the IoT botnets Aisuru and Kimwolf launched a campaign called “The Night Before Christmas,” which generated an attack with a peak load of 31.4 terabits per second—the largest publicly known DDoS attack to date. The attack was triggered via hijacked routers and compromised Android TVs. In March 2026, the Federal Criminal Police Office (BKA), U.S. authorities, and Canadian investigators jointly dismantled a network of over three million hijacked devices that was part of this ecosystem.
This case illustrates the difficulty of permanently shutting down modern botnets. According to a Unit 42 analysis, a new, resilience-focused version of Kimwolf had been active for one month prior to the dismantling of the botnet. This version disguises its attack traffic using identifiers from a legitimate Chrome browser, which makes it nearly impossible for traditional filters to distinguish these requests from those of real users. Therefore, dismantling a botnet does not automatically solve the problem.
This is the most far-reaching case to date and goes beyond traditional botnets. In November 2025, Anthropic revealed that a group believed to be state-sponsored had used its AI coding tool as a largely autonomous attack agent for weeks. Reconnaissance, exploit development, and data analysis were carried out 80 to 90 percent without human intervention.
What This Means for Businesses
The focus of bot defense is shifting. Rather than just detecting traffic, the focus is increasingly on determining whether a request is generated by a script, a human, or an autonomously planning system. Traditional filtering rules based on IP addresses or known signatures will always lag behind this development.
Three shifts are particularly relevant for IT managers:
- Attack tools are being developed faster and more cheaply because AI lowers the technical barrier to entry.
- Bots are increasingly behaving like humans and hiding behind real residential addresses instead of originating from conspicuous data centers.
- The line between automated attacks and autonomously operating systems is blurring.
Those who are still using yesterday’s tools are protecting themselves against a threat that no longer exists in that form.
Bot Defense That Scales with the Threat
From Eggdrop to Mirai to TuxBot, each generation of bots has posed a new challenge for defenses. Today, the question is: Does your security architecture recognize not only how much traffic is coming in, but also what’s behind it?
Link11 WAAP uses behavioral analysis to distinguish between legitimate search engine crawlers and malicious scraping or credential-stuffing bots. This protects against the rapidly evolving types of attacks that use AI.
Would you like to learn how to secure your applications against modern, AI-powered bot attacks? Let’s work together to analyze your current security architecture.
You might also like:
