SSHStalker
SSHStalker is a newly documented Linux botnet that uses Internet Relay Chat (IRC) for command-and-control and spreads primarily by automated SSH scanning and brute-force attacks against servers with weak or reused credentials. Flare researchers reported observing the operation via SSH honeypots over roughly two months in early 2026 and estimated that it had infected about 7,000 systems, with many compromised hosts appearing to be cloud servers, including strong links to Oracle Cloud infrastructure.
The botnet is characterized as a scale-first operation that prioritizes reliability, uptime, and repeatability over stealth. Its deployment chain includes a Golang SSH scanner masquerading as "nmap," on-host installation of GCC, and compilation of multiple C payloads directly on victim systems. The toolkit includes multiple IRC bot variants written in C and Perl, including references to Tsunami and Keiten, redundant IRC servers and channels for resilience, and persistence mechanisms based on cron jobs that relaunch the malware within about 60 seconds if disrupted. Researchers also reported use of memory-backed paths such as /dev/shm, service/init-script persistence via helper scripts, and log-cleaning components that tamper with shell history and utmp/wtmp/lastlog artifacts.
SSHStalker also carries a large catalog of legacy Linux kernel privilege-escalation exploits, largely targeting Linux 2.6.x-era vulnerabilities from 2009-2010, and Flare identified 81 exploit-related artifacts covering 16 CVEs. Additional capabilities directly mentioned in the reporting include rootkit-class artifacts, DDoS-capable IRC bot functionality, cryptomining tooling and configurations, and a web reconnaissance kit designed to harvest exposed AWS access keys from websites at scale. Flare described the operation as exhibiting "dormant persistence": infected systems were enrolled into IRC control infrastructure even when no active tasking was observed. Although the tradecraft resembles Outlaw/Maxlas-style Linux botnets and Romanian-language artifacts were noted, no direct attribution was confirmed.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
“Flare’s research team has uncovered a previously undocumented Linux botnet operation we’re calling SSHStalker… SSHStalker relies on classic, “old-school” IRC botnet mechanics…”
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
5 techniques
Stealth
Credential Access
2 techniques
Credential Access
Discovery
1 technique
Discovery
Lateral Movement
2 techniques
Lateral Movement
Command and Control
3 techniques
Command and Control
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux botnet that gains initial access via automated SSH scanning and brute forcing, uses IRC-based C2, spreads in a worm-like manner by scanning from compromised hosts, and drops additional payloads for privilege escalation, AWS key harvesting, and cryptocurrency mining; uses cron-based persistence and masquerades as nmap.
Linux botnet described as using IRC-style infrastructure/communications.
SSHStalker botnet targets Linux servers with legacy exploits and SSH scanning
Linux botnet leveraging an automated SSH compromise pipeline (scanner + rapid staging/compile-run), noisy persistence (cron/watchdog), IRC-based C2/enrollment, and a backlog of legacy Linux 2.6-era exploits.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.