Tsunami (ELF)
Aliases: Amnesia, Muhstik, Radiation
- First seen
- 2010-01-01 00:00:00
- Malware type
- botnet, ddos
- Family
- Malware family
- Last IoC activity
- 2026-07-21 08:34:00
- Profile updated
- 2026-07-07 13:13:58
Targeted industries: technology-and-telecommunications energy-and-utilities
Context
Tsunami is a Linux-based malware that primarily operates as a botnet and is used for launching distributed denial-of-service (DDoS) attacks. Often targeting IoT devices, it can also be referred to by aliases such as Amnesia, Muhstik, and Radiation, highlighting its capabilities to spread and infect a wide range of devices.
Exploited vulnerabilities
- CVE-2021-26084 (vulnerability)
- CVE-2021-44228 (vulnerability)
- CVE-2022-26134 (vulnerability)
Reports & references
- blog.aquasec.com — 8220 Gang Confluence Vulnerability Cve 2022 26134 (report)
- intezer.com — Teamtnt Cryptomining Explosion (report)
- Broadcom/Symantec — Log4J Vulnerabilities Attacks (report)
- blackberry.com — Report Bb 2021 Threat Report (report)
- blog.netlab.360.com — Public Cloud Threat Intelligence 202203 (report)
- Kaspersky — 98440 (report)
- ibm.com — Wmdzowk6 (report)
- bleepingcomputer.com — Log4Shell Exploits Now Used Mostly For Ddos Botnets Cryptominers (report)
- medium.com — Logs Of Log4Shell Cve 2021 44228 Log4J Is Ubiquitous En 809064312039 (report)
- cadosecurity.com — Analysis Of Initial In The Wild Attacks Exploiting Log4Shell Log4J Cve 2021 44228 (report)
- asec.ahnlab.com — 54647 (report)
- cadosecurity.com — Teamtnt Script Employed To Grab Aws Credentials (report)
- aquasec.com — Container Security Tnt Container Attack (report)
- aquasec.com — Threat Alert Anatomy Of Silentbobs Cloud Attack (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Tsunami (report)
- blog.aquasec.com — New Malware In The Cloud By Teamtnt (report)
- tolisec.com — Multi Vector Minertsunami Botnet With Ssh Lateral Movement (report)
- fortinet.com — Recent Attack Uses Vulnerability On Confluence Server (report)
- blog.aquasec.com — Fileless Malware Container Security (report)
- lacework.com — Muhstik Takes Aim At Confluence Cve 2021 26084 (report)
- akamai.com — 2024 Php Exploit Cve One Day After Disclosure (report)
- blogs.juniper.net — Muhstik Gang Targets Redis Servers (report)
- lacework.com — Meet Muhstik Iot Botnet Infecting Cloud Servers (report)
- researchcenter.paloaltonetworks.com — Unit42 New Iotlinux Malware Targets Dvrs Forms Botnet (report)
- get.cyberx-labs.com — Radiation Report (report)