It is an open source botnet which aims to secure IoT devices from other malicious botnets. It functions in the same manner as that of a computer security system. The devices are updated using its peer to peer networking and then deletes the remaining malware bots. Linux.Wifatch was one of the first vigilante botnets to be used. It logs into the devices using weak telnet credentials and then removes the other malicious botnets and disables the access to telnet. It then shows the message "Telnet has been closed to avoid further infection of this device. Please disable telnet, change telnet passwords, and/or update the firmware."
Hajime is a vigilante bot launched in October 2016 which served the same purpose as Linux.Wifatch to secure the IoT devices against the malware botnets. It is considered to be more advanced than the malicious Mirai botnet. It does not contain any modules for DDoS attacks and only focuses on extending its reach in other to kill the malicious botnets. It uses peer to peer networking. After doing its work, it leaves the message “Just a white hat, securing some systems. Important message will be signed like this!”. It is more efficient than the previous two botnets