POTASSIUMPotassium

Mirai-derived Linux botnet first flagged by Synthient in March 2026. Nokia Deepfield describes a fork using ChaCha20 for the static configuration table, a single static byte (0xED) for all wire traffic, a named reverse-shell protocol (SHELL / SHOUT) sharing the attack command channel, and a DNS misdirection scheme that swaps the two 16-bit halves of every resolved A record before connecting. Arctic Wolf reports 24 flood commands over ICMP, TCP, UDP and OpenVPN, and an Ethereum Name Service C2 resolution path present but disabled in ARM and x86 builds. In October 2026 Sophos observed unsuccessful PHP2Shell (CVE-2026-109618, CVE-2026-109619) exploitation attempts delivering an expanded version with downloader functionality (C2 thunder.godofthunder[.]st, TCP 50792). Not to be confused with POTASSIUM, a vendor synonym of the APT10 / Purple Typhoon espionage actor: the shared name carries no attribution.