SSH-Snake

SSH-Snake is a self-modifying, fileless, self-propagating SSH worm released on 4 January 2024. It is implemented as a bash shell script that autonomously searches a compromised host for SSH private keys, credentials, and related artifacts, including shell history files such as .bash_history. It uses discovered SSH credentials to laterally move to additional systems over SSH, copies itself to those systems, and repeats the process. On first run, it modifies itself by removing comments, whitespace, and unnecessary functions to reduce size. Reported target-discovery sources include shell history as well as commands such as last and arp. Sysdig reported that SSH-Snake has been used in active offensive operations and identified attacker infrastructure storing per-victim output files; observed collected data included discovered credentials, target IP addresses, and victims’ bash history. Sysdig assessed with high confidence that operators deploying SSH-Snake were exploiting known Atlassian Confluence vulnerabilities for initial access in many cases, although other exploits may also have been used. The malware has been associated with the CRYSTALRAY threat actor/campaign cluster, which used SSH-Snake for lateral movement as part of broader operations involving credential theft and cryptominer deployment. Reported victim counts grew from roughly 100 in early observations to campaigns later associated with more than 1,500 victims. High-confidence behavioral indicators mentioned in the content include SSH connections from compromised hosts, reads of sensitive files, searching for private keys or passwords, and harvesting of bash history and SSH-related artifacts.